CVE-2026-27140

Description

SWIG file names containing 'cgo' and well-crafted payloads could lead to code smuggling and arbitrary code execution at build time due to trust layer bypass.

PUBLISHED Reserved 2026-02-17 | Published 2026-04-08 | Updated 2026-04-13 | Assigner Go

Problem types

CWE-501: Trust Boundary Violation

Product status

Credits

Juho Forsén of Mattermost

References

go.dev/cl/763768

go.dev/issue/78335

groups.google.com/g/golang-announce/c/0uYbvbPZRWU

pkg.go.dev/vuln/GO-2026-4871

cve.org (CVE-2026-27140)

nvd.nist.gov (CVE-2026-27140)

Download JSON