CVE-2025-61731

score

<0.1

cvss

7.8

epss

0.6%

published

2026-01-28

kev added

—

first seen

2026-10-21

Go contains a command injection caused by improper handling of "#cgo pkg-config:" directive allowing attacker-controlled "--log-file" argument, letting attackers write to arbitrary files, exploit requires ability to build malicious Go source files.