Building a malicious file with cmd/go can cause can cause a write to an attacker-controlled file with partial control of the file content. The "#cgo pkg-config:" directive in a Go source file provides command-line arguments to provide to the Go pkg-config command. An attacker can provide a "--log-file" argument to this directive, causing pkg-config to write to an attacker-controlled location.
CVSS Details
- CVSS 3.1 Base Score: 7.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade golang-srcUpgrade go-toolsetUpgrade golang-docsUpgrade golangUpgrade golang-miscUpgrade golang-binUpgrade delveUpgrade golang-testsUpgrade golang-race | Mar 31, 2026 | Mar 26, 2026 |
| Alpine Linux | — | Upgrade etcdUpgrade go | Jan 29, 2026 | Jan 28, 2026 |
| Amazon Linux Ami 2 | — | Upgrade amazon-ssm-agentUpgrade golang-sharedUpgrade golang-testsUpgrade golang-miscUpgrade golangUpgrade golang-binUpgrade golang-docsUpgrade golang-src | May 20, 2026 | May 20, 2026 |
| Amazon_linux_2023 | — | Upgrade cni-pluginsUpgrade oci-add-hooks-debugsourceUpgrade captree-debuginfoUpgrade golang-miscUpgrade containerd-stressUpgrade golang-testsUpgrade golang-docsUpgrade golang-binUpgrade golangUpgrade nerdctlUpgrade libcap-staticUpgrade runfinch-finchUpgrade containerd-debuginfoUpgrade golist-debuginfoUpgrade amazon-ecr-credential-helperUpgrade containerd-stress-debuginfoUpgrade oci-add-hooksUpgrade amazon-ssm-agentUpgrade captreeUpgrade soci-snapshotterUpgrade cni-plugins-debuginfoUpgrade golang-sharedUpgrade golang-srcUpgrade amazon-cloudwatch-agentUpgrade oci-add-hooks-debuginfoUpgrade libcap-develUpgrade libcap-debugsourceUpgrade cni-plugins-debugsourceUpgrade libcapUpgrade golist-debugsourceUpgrade golistUpgrade containerd-debugsourceUpgrade libcap-debuginfoUpgrade containerd | Feb 10, 2026 | Jan 28, 2026 |
| Oracle_linux | — | Upgrade golang-binUpgrade golang-srcUpgrade golangUpgrade golang-raceUpgrade golang-miscUpgrade golang-testsUpgrade golang-docsUpgrade delveUpgrade go-toolset | Mar 27, 2026 | Jan 28, 2026 |
| Redhat_linux | — | Upgrade golangUpgrade golang-miscUpgrade delve-debuginfoUpgrade golang-srcUpgrade go-toolsetUpgrade golang-raceUpgrade delveNo solution existsUpgrade golang-testsUpgrade delve-debugsourceUpgrade golang-docsUpgrade golang-bin | Mar 27, 2026 | Jan 28, 2026 |
| Rocky_linux | — | Upgrade delveUpgrade go-toolsetUpgrade golang-raceUpgrade golang-binUpgrade delve-debuginfoUpgrade delve-debugsourceUpgrade golang | Apr 8, 2026 | Apr 7, 2026 |
| Splunk | — | Upgrade Splunk Enterprise to version 10.2.4Upgrade Splunk Enterprise to version 10.0.7Upgrade Splunk Enterprise to version 9.3.12Upgrade Splunk Enterprise to version 9.4.11Upgrade Splunk Enterprise to version 10.0.6Upgrade Splunk Enterprise to version 9.4.12Upgrade Splunk Enterprise to version 9.3.13Upgrade Splunk Enterprise to version 10.2.3Upgrade Splunk Enterprise to version 10.4.0 | Jul 30, 2026 | Jan 28, 2026 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | May 27, 2026 | Jan 28, 2026 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub