Arbitrary code execution during build via line directives in cmd/go

CVE-2023-39323

What is CVE-2023-39323?

A vulnerability in the Go compiler permits the use of line directives ('//line') to circumvent restrictions on '//go:cgo_' directives. This exploitation can inadvertently allow blocked linker and compiler flags to be executed during the 'go build' process, potentially leading to arbitrary code execution. While the complexity of this vulnerability is heightened due to the requirement for the absolute file path of the directive, developers should remain vigilant and apply necessary updates promptly to safeguard their applications.

References