CVE-2025-22867

On Darwin, building a Go module which contains CGO can trigger arbitrary code execution when using the Apple version of ld, due to usage of the @executablepath, @loaderpath, or @rpath special values in a "cgo LDFLAGS" directive. This issue only affected go1.24rc2...

Google Go 安全漏洞

Google Go is a static strongly typed, compiled, concatenated, and garbage-collected programming language from Google USA. A security vulnerability exists in Google Go that stems from the use of Apple's ld with special values in the cgo LDFLAGS instruction on Darwin systems, which could trigger...

Arbitrary Code Execution

github.com/golang/go is vulnerable to Arbitrary Code Execution. The vulnerability is caused by building a GO module which contains Cgo code due to usage of the -ltolibrary flag in a cgo LDFLAGS directive. Note that this vulnerability is only exploitable on Darwin systems...