Go Command Line Tool Arbitrary File Write Vulnerability via Cgo Pkg-Config Directive

A vulnerability in the Go command line tool (cmd/go) allows for arbitrary file writes, with partial control over the file content. This issue arises from the '#cgo pkg-config:' directive in Go source files, which can be manipulated to include unsafe command-line arguments. By providing a '--log-file' option, an attacker can direct pkg-config to write to a location of their choosing.

Impact

Exploitation of this vulnerability could lead to unauthorized writing of files, potentially allowing for further exploitation or manipulation of the system.

Remediation

This vulnerability has been addressed in Go versions 1.24.12 and 1.25.6. Users can download the latest version from the Go website or compile it from source.