High

Arbitrary Code Execution in Go cmd/go via malicious SWIG file names

IdentifiersCVE-2026-27140CWE-641· Improper Restriction of Names for…

CVE-2026-27140 is a build-time arbitrary code execution vulnerability in the Go toolchain, specifically in cmd/go’s handling of SWIG source files in conjunction with cgo. A specially crafted SWIG source file can abuse a file-naming convention containing "cgo" that is trusted within the cgo compilation boundary, enabling a trust-layer bypass and code smuggling during the build process. By causing cmd/go and cgo to treat attacker-controlled SWIG input as trusted in this context, an attacker can trigger unauthorized code execution while the target project is being built. The issue is classified as CWE-641 because exploitation depends on improper restriction of file names and related resource naming semantics. The Go project addressed the flaw by disallowing SWIG files from using the affected naming convention.

For your environment

Are you exposed to this one?

Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.

Start free trial

ANALYST BRIEF

Impact, mitigation & remediation

What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.

Impact

What an attacker gets, and what they’ve been doing with it.

Successful exploitation allows arbitrary code execution during compilation or build, turning the vulnerability into a software supply-chain and developer-environment compromise vector. An attacker who can introduce a malicious SWIG source file into source code, a dependency, or another build input can execute unauthorized code with the privileges of the user or automation system performing the build. This can enable compromise of developer workstations, CI/CD runners, build infrastructure, produced artifacts, and any secrets or credentials accessible in the build environment.

Mitigation

If you can’t patch tonight, do this now.

Until fixed versions are deployed, avoid building untrusted or insufficiently reviewed Go code that uses SWIG or cgo. Restrict who can introduce or modify SWIG inputs in repositories and dependencies, enforce code review on build-related source files, and isolate build environments to reduce blast radius. Running builds in ephemeral, least-privileged, network-restricted CI workers can limit post-exploitation impact. If SWIG is not required, disabling or excluding SWIG-based build paths reduces exposure. Monitoring for unexpected build-time behavior and validating provenance of dependencies can further reduce risk.

Remediation

Patch, then assume compromise.

Upgrade Go to a fixed release that includes the cmd/go and cgo hardening for CVE-2026-27140. The available evidence indicates the issue was fixed in Go 1.25.9 and Go 1.26.2, and downstream vendors remediated it by shipping updated golang or go-toolset packages based on fixed Go releases. The fix disallows SWIG files from using the affected file-naming convention. Apply the vendor-provided security updates for affected distributions and products, and rebuild any artifacts produced in vulnerable build environments if compromise is suspected.

PUBLIC EXPLOITS

Exploits

No public exploits tracked yet. Mallory keeps watching.

VALID 0 / 0 TOTALView more in app

No public exploit code observed for this vulnerability.

EXPOSURE SURFACE

Affected products & vendors

Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.

VendorProductType

GolangGoapplication

GolangGolangapplication

Rocky LinuxDelveapplication

Rocky LinuxGolangapplication

Rocky LinuxModule.Delveapplication

Rocky LinuxModule.Golangapplication

Vendor-confirmed product mapping. Mallory continuously reconciles this list against your asset inventory.

ACTIVITY FEED

Recent activity

26 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

26 SOURCESView more in app

redhat accessNews

May 13, 2026

RHSA-2026:16694 - Security Advisory - Red Hat Customer Portal

An arbitrary code execution vulnerability in Go/cmd/go triggered via malicious SWIG file names.

redhat accessNews

May 13, 2026

RHSA-2026:16698 - Security Advisory - Red Hat Customer Portal

An arbitrary code execution vulnerability in Go/cmd/go triggered via malicious SWIG file names.

redhat accessNews

May 11, 2026

RHSA-2026:16024 - Security Advisory - Red Hat Customer Portal

An arbitrary code execution vulnerability in Go and cmd/go via malicious SWIG file names.

redhat accessNews

May 11, 2026

RHSA-2026:16021 - Security Advisory - Red Hat Customer Portal

An arbitrary code execution vulnerability in Go and cmd/go caused by malicious SWIG file names.

+5 more in the timeline

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets are affected, which adversaries are exploiting it right now, which detections to deploy, and what to do tonight.

Start free trial

Exposure mapping

Query your assets running an affected version, and investigate the blast radius.

Threat actor evidence

Every observed campaign linking this CVE to a named adversary.

Associated malware

Malware families riding this exploit, with evidence and IOCs.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

Vendor-by-vendor mapping

Cross-references every affected SKU, including bundled OEM variants.

Social activity12