High · published January 29, 2026
⚡ A carefully crafted Go source file can open a backdoor for attackers to write to their own files! 🎉 Think of it like a restaurant kitchen that blindly accepts any special request from customers without checking the order — one sneaky diner could get their hands on the recipe book! 🍽️ If exploited, an attacker could manipulate the build process to write malicious content wherever they choose, potentially leading to system compromise or data loss. It's like giving someone the keys to your pantry and letting them decide what ingredients to use for their next meal — and you might not like the dish they cook up!
Think of it like a restaurant kitchen that blindly accepts any special request from customers without checking the order — one sneaky diner could get their hands on the recipe book! 🍽️ This vulnerability arises from the misuse of the '#cgo pkg-config:' directive in Go, allowing an attacker to specify a '--log-file' argument that points to an attacker-controlled location, leading to unauthorized file writes.
If exploited, an attacker could manipulate the build process to write malicious content wherever they choose, potentially leading to system compromise or data loss. It's like giving someone the keys to your pantry and letting them decide what ingredients to use for their next meal — and you might not like the dish they cook up! Developers should review their Go source files for the use of '#cgo pkg-config:' directives and ensure they do not accept arbitrary input. Update your codebase and consider using strict validation on any command-line arguments provided. Additionally, monitor your build processes for any unexpected file write operations. 🛡️ You've got this! With a little diligence, you can secure your Go applications and keep those pesky attackers at bay! 🚀
| Product | Versions | Fixed in |
|---|---|---|
| golang/go | < 1.24.12 | 1.24.12 |
| golang/go | ≥ 1.25.0, < 1.25.6 | 1.25.6 |