Building a malicious file with cmd/go can cause can cause a write to an attacker-controlled file with partial control of the file content. The "#cgo pkg-config:" directive in a Go source file provides command-line arguments to provide to the Go pkg-config command. An attacker can provide a "--log-file" argument to this directive, causing pkg-config to write to an attacker-controlled location.
CVSS Details
- CVSS 3.1 Base Score: 7.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade delveUpgrade golang-raceUpgrade golang-testsUpgrade golang-srcUpgrade golang-docsUpgrade golang-miscUpgrade golang-binUpgrade go-toolsetUpgrade golang | Mar 31, 2026 | Mar 26, 2026 |
| Alpine Linux | — | Upgrade etcdUpgrade go | Jan 29, 2026 | Jan 28, 2026 |
| Amazon Linux Ami 2 | — | Upgrade golang-testsUpgrade golang-sharedUpgrade amazon-ssm-agentUpgrade golang-miscUpgrade golang-binUpgrade golangUpgrade golang-srcUpgrade golang-docs | May 20, 2026 | May 20, 2026 |
| Amazon_linux_2023 | — | Upgrade containerd-debugsourceUpgrade amazon-ssm-agentUpgrade libcap-develUpgrade cni-plugins-debugsourceUpgrade libcap-debugsourceUpgrade oci-add-hooksUpgrade libcap-debuginfoUpgrade containerdUpgrade golist-debuginfoUpgrade cni-plugins-debuginfoUpgrade amazon-ecr-credential-helperUpgrade containerd-stress-debuginfoUpgrade golang-srcUpgrade amazon-cloudwatch-agentUpgrade golang-sharedUpgrade captreeUpgrade golist-debugsourceUpgrade golistUpgrade oci-add-hooks-debuginfoUpgrade containerd-debuginfoUpgrade soci-snapshotterUpgrade libcapUpgrade golangUpgrade captree-debuginfoUpgrade golang-binUpgrade golang-docsUpgrade golang-miscUpgrade cni-pluginsUpgrade containerd-stressUpgrade oci-add-hooks-debugsourceUpgrade runfinch-finchUpgrade golang-testsUpgrade nerdctlUpgrade libcap-static | Feb 10, 2026 | Jan 28, 2026 |
| Oracle_linux | — | Upgrade go-toolsetUpgrade golang-docsUpgrade delveUpgrade golang-srcUpgrade golang-testsUpgrade golang-raceUpgrade golang-binUpgrade golang-miscUpgrade golang | Mar 27, 2026 | Jan 28, 2026 |
| Redhat_linux | — | Upgrade delve-debugsourceNo solution existsUpgrade golang-binUpgrade golang-testsUpgrade golang-docsUpgrade delve-debuginfoUpgrade golang-miscUpgrade golang-raceUpgrade golang-srcUpgrade golangUpgrade delveUpgrade go-toolset | Mar 27, 2026 | Jan 28, 2026 |
| Rocky_linux | — | Upgrade go-toolsetUpgrade delveUpgrade golang-raceUpgrade golang-binUpgrade delve-debuginfoUpgrade golangUpgrade delve-debugsource | Apr 8, 2026 | Apr 7, 2026 |
| Splunk | — | Upgrade Splunk Enterprise to version 9.4.12Upgrade Splunk Enterprise to version 9.3.13Upgrade Splunk Enterprise to version 10.2.3Upgrade Splunk Enterprise to version 10.4.0Upgrade Splunk Enterprise to version 9.3.12Upgrade Splunk Enterprise to version 10.2.4Upgrade Splunk Enterprise to version 10.0.6Upgrade Splunk Enterprise to version 10.0.7Upgrade Splunk Enterprise to version 9.4.11 | Jul 30, 2026 | Jan 28, 2026 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | May 27, 2026 | Jan 28, 2026 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub