A high-severity flaw in the Go toolchain permits unauthorized file writes, potentially leading to system compromise via OS command injection.

The vulnerability stems from improper neutralization of command-line arguments within the #cgo pkg-config directive. By supplying a --log-file argument, a local attacker with low privileges can force the tool to write to arbitrary locations on the filesystem.

The ability to write to attacker-controlled files on a system typically leads to complete compromise of confidentiality, integrity, and availability. With a CVSS score of 7.8, this flaw represents a significant risk to development environments and CI/CD pipelines where untrusted Go source code might be processed. Exploitation could allow an attacker to overwrite sensitive configuration files or inject malicious code into build processes.

Immediate Action: Update the Go toolchain to version 1.24.12, 1.25.6, or newer versions that contain the fix for this directive injection issue.

Proactive Monitoring: Review build logs for unexpected file write operations or unusual command-line arguments passed to the pkg-config tool during the compilation phase.

Compensating Controls: Ensure that Go projects are built in isolated, ephemeral environments with restricted filesystem permissions to limit the impact of potential file-write exploits.

Public Exploit Available: No

Given the potential for total system impact and the role of the Go toolchain in modern software development, organizations must prioritize updating their build environments. Failure to patch allows for a critical vector of attack against the software supply chain. Please ensure all build agents and developer workstations running affected versions of the Go toolchain are updated immediately.