VDB

GHSA-xvqr-69v8-f3gv

GHSA-xvqr-69v8-f3gv PUBLISHED CVSS 7.800000190734863 HIGH

Building a malicious file with cmd/go can cause can cause a write to an attacker-controlled file with partial control of the file content. The "#cgo pkg-config:" directive in a Go source file provides command-line arguments to provide to the Go pkg-config command. An attacker can provide a "--log-file" argument to this directive, causing pkg-config to write to an attacker-controlled location.

Risk Scores

CVSS 3.1
7.800000190734863
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Affected Products

VendorProductVersions
chainguardcloud-provider-aws-fips-1.310
wolfitelegraf-1.360
chainguardprometheus-alertmanager-fips0
chainguardtfsec0
wolfipg_timetable0
chainguardmockgen0
chainguardkyverno-policy-reporter-kyverno-plugin-fips0
chainguardredis-operator-fips0
wolfikubernetes-csi-external-resizer0
chainguardkong-ingress-controller-fips0
chainguardk8s-metacollector0
chainguardtekton-pipelines-fips-0.650
chainguarddoppler-kubernetes-operator0
chainguardchaos-mesh-fips0
chainguardcloud-provider-azure-fips-1.320
chainguardlonghorn-manager-1.100
wolfibank-vaults0
chainguardvelero-plugin-for-gcp-fips0
chainguardmig-parted-fips0
chainguardneuvector-dbgen-fips0

…and 1494 more

Timeline

  • Jan 28, 2026 CVE Published
  • Apr 10, 2026 Security Advisory
  • Jul 9, 2026 CVE Updated
  • Aug 6, 2026 Distribution Patch
  • Aug 6, 2026 Distribution Patch
  • Aug 6, 2026 Distribution Patch
  • Aug 6, 2026 Distribution Patch
  • Aug 6, 2026 Distribution Patch
  • Aug 6, 2026 Distribution Patch
  • Aug 6, 2026 Distribution Patch
  • Aug 6, 2026 Distribution Patch
  • Aug 6, 2026 Distribution Patch

References

…and 21 more

Open in Interactive Console →
$ Console Community · 50/day Open console ›