A critical code injection vulnerability in the Go toolchain cmd/cgo enables attackers to smuggle malicious code into compiled binaries, posing a significant risk of arbitrary code execution.

This vulnerability, categorized as CWE-94, involves improper control of code generation where inconsistent parsing between Go and C/C++ comments allows for code smuggling. The attack vector is local (AV:L), requiring user interaction (UI:R) to trigger the build process with malicious input.

The vulnerability carries a CVSS score of 8.6, reflecting its high impact on system integrity and confidentiality. Successful exploitation permits an attacker to inject arbitrary code into the final binary, which could lead to unauthorized system access, data exfiltration, or complete compromise of the affected environment where the compiled software is executed.

Immediate Action: Update the Go toolchain to versions 1.24.13 or 1.25.7, or later, to incorporate the necessary patches for comment parsing.

Proactive Monitoring: Review build pipelines and CI/CD logs for anomalous activity or unexpected modifications to source code files during the compilation process.

Compensating Controls: Implement strict supply chain security measures, including code signing and integrity checks, to ensure that only authorized and verified code is included in production binaries.

Public Exploit Available: Unknown

Given the potential for code injection within the build pipeline, organizations must treat this vulnerability with high urgency. Patching the Go toolchain is the only effective way to remediate the underlying parsing discrepancy. Developers should prioritize updating their development environments and CI/CD runners to the fixed versions immediately to prevent the introduction of malicious code into their software supply chain.