CVSS 3.1
7.5 highCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:HCVE-2020-28366
High (7.5). EPSS 2.3% chance of exploitation in the next 30 days. Fixed in toolchain 1.14.12, 1.15.5.
Code injection in the go command with cgo before Go 1.14.12 and Go 1.15.5 allows arbitrary code execution at build time via a malicious unquoted symbol name in a linked object file.
Severity
- EPSS
- 2.3% chance of exploitation in the next 30 days; higher than 83% of CVEs (scores of 2026-10-31)
- CWE
- CWE-94
- Published
- Modified
- Record from
- the NVD, synced
Affected
- fedoraproject:fedora
- golang:go
- netapp:cloud_insights_telegraf_agent
- netapp:trident
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GO-2022-0475 | Go | toolchain | <1.14.12 >=1.15.0-0 <1.15.5 | 1.14.12, 1.15.5 |