← CVE Intelligence

CVE-2026-27140

Code execution vulnerability in SWIG code generation in cmd/go PUBLISHED

Description (CNA)

SWIG file names containing 'cgo' and well-crafted payloads could lead to code smuggling and arbitrary code execution at build time due to trust layer bypass.

Affected (CNA)

Vendor / productVersions
Go toolchain / cmd/goaffected 0 before 1.25.9; affected 1.26.0-0 before 1.26.2

CWE

No CWE identifiers supplied.

References

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.

redhat-SADP

A flaw was found in the Go programming language (golang) and its command-line tool (cmd/go). A remote attacker could exploit this during the build process by crafting malicious SWIG (Simplified Wrapper and Interface Generator) file names that contain "cgo" and specific payloads. This could lead to code smuggling and arbitrary code execution, bypassing trust mechanisms and allowing the attacker to run unauthorized code.