Code injection via go command with cgo in cmd/go

CVE-2023-29402

What is CVE-2023-29402?

The Go command may generate unexpected code during the build process when utilizing cgo, particularly when handling untrusted modules with directory names that include newline characters. This can lead to erratic behavior when executing Go programs that rely on the cgo feature. Notably, modules retrieved through the go command, such as via 'go get', are not susceptible; however, those accessed using GOPATH mode (GO111MODULE=off) may face this issue. Developers should be cautious when working with untrusted modules to mitigate potential risks.

References