CVE-2026-27140

Опубликовано: 08 апр. 2026

Источник: nvd

CVSS3: 8.8

CVSS3: 9

EPSS Низкий

Описание

SWIG file names containing 'cgo' and well-crafted payloads could lead to code smuggling and arbitrary code execution at build time due to trust layer bypass.

Ссылки

Уязвимые конфигурации

Конфигурация 1

Одно из

cpe:2.3:a:golang:go:*:*:*:*:*:*:*:*

Версия до 1.25.9 (исключая)

cpe:2.3:a:golang:go:*:*:*:*:*:*:*:*

Версия от 1.26.0 (включая) до 1.26.2 (исключая)

EPSS

Процентиль: 48%

0.00658

Низкий

8.8 High

CVSS3

9 Critical

CVSS3

Дефекты

CWE-863

CWE-641

Связанные уязвимости

CVE-2026-27140

CVSS3: 8.8

ubuntu

4 месяца назад

SWIG file names containing 'cgo' and well-crafted payloads could lead to code smuggling and arbitrary code execution at build time due to trust layer bypass.

CVE-2026-27140

CVSS3: 9

redhat

4 месяца назад

SWIG file names containing 'cgo' and well-crafted payloads could lead to code smuggling and arbitrary code execution at build time due to trust layer bypass.

CVE-2026-27140

msrc

2 месяца назад

Code execution vulnerability in SWIG code generation in cmd/go

CVE-2026-27140

CVSS3: 8.8

debian

4 месяца назад

SWIG file names containing 'cgo' and well-crafted payloads could lead ...

GHSA-5w89-2c2x-6x66

CVSS3: 8.8

github

4 месяца назад

SWIG file names containing 'cgo' and well-crafted payloads could lead to code smuggling and arbitrary code execution at build time due to trust layer bypass.

EPSS

Процентиль: 48%

0.00658

Низкий

8.8 High

CVSS3

9 Critical

CVSS3

Дефекты

CWE-863

CWE-641