CVE-2020-28366

CVE-2020-28366 describes a code injection vulnerability in the Go command's cgo functionality, affecting Go versions prior to 1.14.12 and 1.15.5, as well as products from fedoraproject, golang, and netapp. This flaw allows for arbitrary code execution during the build process if a malicious, unquoted symbol name is present in a linked object file. With a CVSS score of 7.5 (HIGH), this vulnerability has a network attack vector and high impact on confidentiality, integrity, and availability, though it requires user interaction and has high attack complexity. Currently, there is no evidence of active exploitation, public exploit code, or significant community discussion surrounding this CVE.