Go SWIG Trust Layer Bypass Vulnerability Leading to Code Execution

A vulnerability exists in the Go programming language's SWIG interface handling, specifically within the 'cmd/go' command. This issue arises from a trust layer bypass that allows well-crafted SWIG source files to exploit a file-naming convention recognized by the cgo compiler. As a result, the vulnerability could lead to code smuggling and arbitrary code execution during the build process. This issue affects Go versions prior to 1.25.9 and between 1.26.0 and 1.26.2.

Impact

Exploitation of this vulnerability could result in unauthorized code execution during the build process, potentially allowing malicious actors to execute arbitrary code in the context of the user building the Go application.

Remediation

Users can upgrade to Go versions 1.26.2 or 1.25.9, both of which include the patch for this vulnerability.