toolchain vulnerabilities

CVEs whose affected-version data names the toolchain package (go). Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.

4 CVEsRSS

CVE-2026-94447High· 7.8

3w ago

Previously, a user operating inside of a malicious Go project that defines a bogus golang.org/toolchain go.sum entry and operates a malicious GOMODPROXY the user chooses to use can bypass the intended checksum

Previously, a user operating inside of a malicious Go project that defines a bogus golang.org/toolchain go.sum entry and operates a malicious GOMODPROXY the user chooses to use can bypass the intended checksum. We now ensure that golang.…

▾ Twilighttoolchain · toolchainEPSS 0.10%via NVD

CVE-2026-94444High· 7.8

3w ago

Previously, a user operating inside of a malicious Go project that defines a bogus golang.org/fips140 and operates a malicious GOMODPROXY the user chooses to connect to can serve an arbitrary module in its place

Previously, a user operating inside of a malicious Go project that defines a bogus golang.org/fips140 and operates a malicious GOMODPROXY the user chooses to connect to can serve an arbitrary module in its place. We now unpack the truste…

▾ Twilighttoolchain · toolchainEPSS 0.10%via NVD

CVE-2026-39817Medium· 5.9

5mo ago

Invoking "go tool pack" does not sanitize output paths in cmd/go

▾ Sunlittoolchain · toolchainEPSS 0.17%via OSV

CVE-2026-39819Medium· 4.4

5mo ago

Invoking "go bug" follows symlinks in predictable temporary filenames in cmd/go

▾ Sunlittoolchain · toolchainEPSS 0.18%via OSV