Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
7.8
go1.27 build can let attacker modify a file
published 1 month ago
Summary
The Go programming language version 1.27 allows a specially crafted source file to cause the build tool to write data to a file chosen by an attacker. This could let the attacker change part of the file’s contents, potentially affecting the software being built or deployed. Update to the latest Go release or apply the provided patch to prevent this behavior.
What to do
- Update cleanstart go1.27 to version 1.25.5-r1.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| CleanStart | cleanstart | go1.27 |
< 1.25.5-r1 Fix: upgrade to 1.25.5-r1
|
Original advisory text
Building a malicious file with cmd/go can cause can cause a write to an attacker-controlled file with partial control of the file content
Security vulnerability affects the go1.27 package. Building a malicious file with cmd/go can cause can cause a write to an attacker-controlled file with partial control of the file content.
Internet-facing
14 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit (estimated)
- Gives an attacker full control (estimated)
Timeline
Published6 Oct 2026
Updated6 Oct 2026
First seen6 Oct 2026
Sources
CLEANSTART-2026-IF00623 · OSV
Track software like this
Free during beta