CVE-2026-27140

HIGH

Go cmd/go < 1.25.9 and < 1.26.2 - SWIG Build-Time Code Execution

Title source: manual
STIX 2.1

Description

SWIG file names containing 'cgo' and well-crafted payloads could lead to code smuggling and arbitrary code execution at build time due to trust layer bypass.

References (21)

Core 21
Core References

Scores

CVSS v3 8.8
EPSS 0.0066
EPSS Percentile 48.0%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

CISA SSVC

Vulnrichment
Exploitation none
Automatable no
Technical Impact total

Details

CWE
CWE-641 CWE-863
Status published
Products (3)
Go toolchain/cmd/go < 1.25.9
Go toolchain/cmd/go 1.26.0-0 - 1.26.2
golang/go < 1.25.9
Published Apr 08, 2026
Tracked Since Apr 08, 2026