Code injection in the go command with cgo before Go 1.14.12 and Go 1.15.5 allows arbitrary code execution at build time via a malicious unquoted symbol name in a linked object file.
{ "cpes": [ "cpe:2.3:a:golang:go:*:*:*:*:*:*:*:*" ], "severity": "High" }