Find real vulnerabilities before they ship
Code injection in the go command with cgo before Go 1.14.12 and Go 1.15.5 allows arbitrary code execution at build time via malicious gcc flags specified via a #cgo directive.
Base Score
7.5
| Base Score | 7.5 |
|---|---|
| Vector String | CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H |
| Base Severity | High |
| Version | 3.1 |
| Attack Vector (AV) | NETWORK |
