id: GO-2025-3428
modules:
    - module: cmd
      versions:
        - introduced: 1.24.0-rc.2
        - fixed: 1.24.0-rc.3
      vulnerable_at: 1.24.0-rc.2
      packages:
        - package: cmd/go
          goos:
            - darwin
summary: Arbitrary code execution during build on darwin in cmd/go
description: |-
    On Darwin, building a Go module which contains CGO can trigger arbitrary code
    execution when using the Apple version of ld, due to usage of the
    @executable_path, @loader_path, or @rpath special values in a "#cgo LDFLAGS"
    directive. This issue only affected go1.24rc2.
credits:
    - Juho Forsén of Mattermost
references:
    - fix: https://go.dev/cl/646996
    - report: https://go.dev/issue/71476
    - web: https://groups.google.com/g/golang-dev/c/TYzikTgHK6Y
cve_metadata:
    id: CVE-2025-22867
    cwe: 'CWE-77: Improper Neutralization of Special Elements used in a Command (''Command Injection'')'
source:
    id: go-security-team
    created: 2025-02-06T10:35:16.796971-05:00
review_status: REVIEWED