CVE-2026-27140 | cmd-go up to 1.25.8/1.26.1 on Go SWIG File Parser trust boundary violation

VDB-356008 · CVE-2026-27140 · GCVE-0-2026-27140 CMD-GO UP TO 1.25.8/1.26.1 ON GO SWIG FILE PARSER TRUST BOUNDARY VIOLATION HISTORYDIFFRELATEJSONXMLCTI CVSS Meta Temp Score Current Exploit Price (≈) CTI Interest Score 7.0 $0-$5k 0.58+ Summaryinfo A vulnerability, which was classified as critical, was found in cmd-go up to 1.25.8/1.26.1 on Go. This issue affects some unknown processing of the component SWIG File Parser. Executing a manipulation can lead to trust boundary violation. This vulnerability appears as CVE-2026-27140. The attack may be performed from remote. There is no available exploit. You should upgrade the affected component. Detailsinfo A vulnerability has been found in cmd-go up to 1.25.8/1.26.1 on Go and classified as critical. This vulnerability affects some unknown functionality of the component SWIG File Parser. The manipulation with an unknown input leads to a trust boundary violation vulnerability. The CWE definition for the vulnerability is CWE-501. The product mixes trusted and untrusted data in the same data structure or structured message. As an impact it is known to affect confidentiality, integrity, and availability. CVE summarizes: SWIG file names containing 'cgo' and well-crafted payloads could lead to code smuggling and arbitrary code execution at build time due to trust layer bypass. This vulnerability was named CVE-2026-27140 since 02/17/2026. The exploitation appears to be easy. The attack can be initiated remotely. No form of authentication is required for a successful exploitation. There are neither technical details nor an exploit publicly available. Upgrading to version 1.25.9 or 1.26.2 eliminates this vulnerability. Productinfo Name cmd-go Version 1.25.0 1.25.1 1.25.2 1.25.3 1.25.4 1.25.5 1.25.6 1.25.7 1.25.8 1.26.0 1.26.1 CPE 2.3info 🔒 🔒 🔒 CPE 2.2info 🔒 🔒 🔒 CVSSv4info VulDB Vector: 🔒 VulDB Reliability: 🔍 CVSSv3info VulDB Meta Base Score: 7.3 VulDB Meta Temp Score: 7.0 VulDB Base Score: 7.3 VulDB Temp Score: 7.0 VulDB Vector: 🔒 VulDB Reliability: 🔍 CVSSv2info Vector Complexity Authentication Confidentiality Integrity Availability Unlock Unlock Unlock Unlock Unlock Unlock Unlock Unlock Unlock Unlock Unlock Unlock Unlock Unlock Unlock Unlock Unlock Unlock VulDB Base Score: 🔒 VulDB Temp Score: 🔒 VulDB Reliability: 🔍 Exploitinginfo Class: Trust boundary violation CWE: CWE-501 CAPEC: 🔒 ATT&CK: 🔒 Physical: No Local: No Remote: Yes Availability: 🔒 Status: Not defined Price Prediction: 🔍 Current Price Estimation: 🔒 0-Day Unlock Unlock Unlock Unlock Today Unlock Unlock Unlock Unlock Threat Intelligenceinfo Interest: 🔍 Active Actors: 🔍 Active APT Groups: 🔍 Countermeasuresinfo Recommended: Upgrade Status: 🔍 0-Day Time: 🔒 Upgrade: cmd-go 1.25.9/1.26.2 Timelineinfo 02/17/2026 CVE reserved 04/08/2026 +49 days Advisory disclosed 04/08/2026 +0 days VulDB entry created 04/08/2026 +0 days VulDB entry last update Sourcesinfo Status: Confirmed CVE: CVE-2026-27140 (🔒) GCVE (CVE): GCVE-0-2026-27140 GCVE (VulDB): GCVE-100-356008 Entryinfo Created: 04/08/2026 08:01 Changes: 04/08/2026 08:01 (52) Complete: 🔍 Cache ID: 99:BD6:101 Discussion No comments yet. Languages: en. Please log in to comment. ◂ PreviousOverviewNext ▸