CVSS 3.1
7.5 highCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:HCVE-2020-28367
High (7.5) in golang go. EPSS 2.4% chance of exploitation in the next 30 days. Fixed in toolchain 1.14.12, 1.15.5.
Code injection in the go command with cgo before Go 1.14.12 and Go 1.15.5 allows arbitrary code execution at build time via malicious gcc flags specified via a #cgo directive.
Severity
- EPSS
- 2.4% chance of exploitation in the next 30 days; higher than 84% of CVEs (scores of 2026-10-31)
- CWE
- CWE-94
- Published
- Modified
- Record from
- the NVD, synced
Affected
- golang:go
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GO-2022-0476 | Go | toolchain | <1.14.12 >=1.15.0-0 <1.15.5 | 1.14.12, 1.15.5 |