CVE-2020-28367 Arbitrary code execution via the go command with cgo in cmd/go

Api.Msrc.Microsoft • February 18, 2026

Share: View original

Information published.

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Multiple CVEs Identified for Code Injection and Execution via Go Command Two vulnerabilities have been reported related to the Go programming language's command line tool. CVE-2023-29402, published on June 8, 2023, involves code injection via the 'go' command with cgo, while CVE-2020-28367, published on November 18, 2020, allows for arbitrary code execution in a similar context. Both vulnerabilities affect users of the Go toolchain utilizing cgo. 2 sources 53

Extracted Entities

Attack Types (1)

Zero-day Exploit

CVEs (1)

MITRE ATT&CK (2)

Go T1059 - Command and Scripting Interpreter