The go command may execute arbitrary code at build time when using cgo on Windows. This can be triggered by running go get on a malicious module, or any other time the code is built.
{ "review_status": "REVIEWED", "url": "https://pkg.go.dev/vuln/GO-2021-0068" }