EUVD-2026-123102

Building a malicious package that uses cgo could bypass "cgo LDFLAGS" validation and cause unexpected code execution at build time, or cause the go command to panic, via crafted quoting in "//go:cgoldflag" directives. When "cmd/cgo" generates "cgogotypes.go", it quotes each "cgo LDFLAGS" argument...