SWIG file names containing 'cgo' and well-crafted payloads could lead to code smuggling and arbitrary code execution at build time due to trust layer bypass.
| Vendor | Product | Versions |
|---|---|---|
| go toolchain | cmd/go | 0, 1.26.0-0 |
Updated severity to CRITICAL, added affected versions 1.25.8 and 1.26.1, and corrected exploit availability to false.
Initial creation
