CVE-2026-27140

Code execution vulnerability in SWIG code generation in cmd/go

Published Apr 8, 2026 CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed
Description
SWIG file names containing 'cgo' and well-crafted payloads could lead to code smuggling and arbitrary code execution at build time due to trust layer bypass.

Remediation

No solution or workaround provided in the CVE record

Tracking

Sign in to view the affected projects.

Advisories

No advisories available
History
Type Values Removed Values Added
First Time appeared Golang
Golang go
Weaknesses CWE-863
CPEs cpe:2.3:a:golang:go:*:*:*:*:*:*:*:*
Vendors & Products Golang
Golang go
Type Values Removed Values Added
Weaknesses CWE-94
Type Values Removed Values Added
Metrics cvssV3_1

{'score': 9.0, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H'}

ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

cvssV3_1

{'score': 8.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H'}

Type Values Removed Values Added
Weaknesses CWE-641
References
Metrics threat_severity

None

cvssV3_1

{'score': 9.0, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H'}

threat_severity

Important

Type Values Removed Values Added
First Time appeared Gotoolchain
Gotoolchain cmd/go
Vendors & Products Gotoolchain
Gotoolchain cmd/go
Type Values Removed Values Added
Weaknesses CWE-94
Type Values Removed Values Added
Description SWIG file names containing 'cgo' and well-crafted payloads could lead to code smuggling and arbitrary code execution at build time due to trust layer bypass.
Title Code execution vulnerability in SWIG code generation in cmd/go
References
Weaknesses

Sources

Status
PUBLISHED
Assigner
Go
Published
Updated
Sep 10, 2026, 12:04 PM
Reserved
Feb 17, 2026, 7:57 PM
Status
Modified
Published
Apr 8, 2026, 2:16 AM
Modified
Sep 10, 2026, 1:17 PM
Severity
Important
Public date
Apr 8, 2026, 1:06 AM