Is CVE-2026-27140 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-27140 being exploited in the wild.

How severe is CVE-2026-27140?

High severity, with a CVSS score of 8.8, published 8 April 2026.

Which products and versions are affected?

toolchain (Go) SEMVER:introduced=0,fixed=1.25.9,introduced=1.26.0-0,fixed=1.26.2.

Is there a fix for CVE-2026-27140?

Yes. toolchain (Go): upgrade to 1.26.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-27140 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-27140?

Check whether you run toolchain (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-27140: Google Go arbitrary code execution via malicious SWIG file names

CVE-2026-27140 · Severity: high · CVSS 8.8 · Published 2026-04-08

A vulnerability in the Go programming language's build system could allow an attacker to execute malicious code on a developer's machine or build server. This occurs when the build tool processes specially crafted source files that use the SWIG interface generator. If a developer attempts to build a project containing these malicious files, the attacker could gain full control over the build environment, potentially leading to the theft of source code or the insertion of backdoors into software products.

Technologies: toolchain (Go). Vendors: Go.

Quick answers

Is CVE-2026-27140 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-27140 being exploited in the wild.
How severe is CVE-2026-27140?: High severity, with a CVSS score of 8.8, published 8 April 2026.
Which products and versions are affected?: toolchain (Go) SEMVER:introduced=0,fixed=1.25.9,introduced=1.26.0-0,fixed=1.26.2.
Is there a fix for CVE-2026-27140?: Yes. toolchain (Go): upgrade to 1.26.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-27140 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-27140?: Check whether you run toolchain (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

toolchain (Go): upgrade to 1.26.2 or later
```
go get toolchain@v1.26.2
```

Technical details

A trust layer bypass exists in the Go 'cmd/go' tool when processing SWIG (Simplified Wrapper and Interface Generator) files. The vulnerability stems from improper restriction of file names; specifically, SWIG file names containing the string 'cgo' can be used to exploit a file-naming convention used within the cgo compiler's trust boundary. By providing a well-crafted SWIG source file with a malicious name and payload, an attacker can achieve code smuggling and arbitrary code execution at build time. This requires a user to attempt to build a malicious package. The issue is fixed in Go versions 1.25.9 and 1.26.2.

Affected products

Google Go before 1.25.9, 1.26.0 to 1.26.1
Red Hat Enterprise Linux 8, 10

Identifiers

CVE-2026-27140
GO-2026-4871

Timeline

2026-03-24: disclosed: Issue opened on Go GitHub repository
2026-04-07: advisory: Go project advisory GO-2026-4871 published
2026-04-08: advisory: NVD published CVE-2026-27140
2026-04-23: patched: Red Hat released security updates for RHEL 10

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.