Building a malicious file with cmd/go can cause can cause a write to an attacker-controlled file with partial control of the file content. The "#cgo pkg-config:" directive in a Go source file provides command-line arguments to provide to the Go pkg-config command. An attacker can provide a "--log-file" argument to this directive, causing pkg-config to write to an attacker-controlled location.
Metrics
Affected Vendors & Products
| Vendors | Products |
|---|---|
| Gotoolchain |
|
No data.
No data.
References
History
Thu, 29 Jan 2026 17:15:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Metrics |
cvssV3_1
|
Thu, 29 Jan 2026 10:15:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| First Time appeared |
Gotoolchain
Gotoolchain cmd/go |
|
| Vendors & Products |
Gotoolchain
Gotoolchain cmd/go |
Wed, 28 Jan 2026 19:45:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | Building a malicious file with cmd/go can cause can cause a write to an attacker-controlled file with partial control of the file content. The "#cgo pkg-config:" directive in a Go source file provides command-line arguments to provide to the Go pkg-config command. An attacker can provide a "--log-file" argument to this directive, causing pkg-config to write to an attacker-controlled location. | |
| Title | Arbitrary file write using cgo pkg-config directive in cmd/go | |
| References |
|
MITRE
Status: PUBLISHED
Assigner: Go
Published: 2026-01-28T19:30:30.844Z
Updated: 2026-01-29T16:17:24.194Z
Reserved: 2025-09-30T15:05:03.605Z
Link: CVE-2025-61731
Vulnrichment
Updated: 2026-01-29T16:17:20.484Z
NVD
Status : Awaiting Analysis
Published: 2026-01-28T20:16:10.073
Modified: 2026-01-29T17:16:19.917
Link: CVE-2025-61731
Redhat
No data.