Executive brief
A vulnerability in the Go programming language's build system could allow an attacker to execute malicious code on a developer's machine or build server. This occurs when the build tool processes specially crafted source files that use the SWIG interface generator. If a developer attempts to build a project containing these malicious files, the attacker could gain full control over the build environment, potentially leading to the theft of source code or the insertion of backdoors into software products.
Technical details
A trust layer bypass exists in the Go 'cmd/go' tool when processing SWIG (Simplified Wrapper and Interface Generator) files. The vulnerability stems from improper restriction of file names; specifically, SWIG file names containing the string 'cgo' can be used to exploit a file-naming convention used within the cgo compiler's trust boundary. By providing a well-crafted SWIG source file with a malicious name and payload, an attacker can achieve code smuggling and arbitrary code execution at build time. This requires a user to attempt to build a malicious package. The issue is fixed in Go versions 1.25.9 and 1.26.2.
Affected products
- Google Go before 1.25.9, 1.26.0 to 1.26.1
- Red Hat Enterprise Linux 8, 10
Timeline
- 2026-03-24: disclosed: Issue opened on Go GitHub repository
- 2026-04-07: advisory: Go project advisory GO-2026-4871 published
- 2026-04-08: advisory: NVD published CVE-2026-27140
- 2026-04-23: patched: Red Hat released security updates for RHEL 10