CVE-2020-28367

CVE-2020-28367 describes a code injection vulnerability in the Go command's cgo functionality, affecting Go versions prior to 1.14.12 and 1.15.5. This flaw allows for arbitrary code execution during the build process if malicious gcc flags are specified through a #cgo directive. Rated as High severity (CVSS 7.5), it requires user interaction and high attack complexity, but could lead to complete compromise of confidentiality, integrity, and availability. There is no evidence of active exploitation, nor are there known public exploits or significant community discussion surrounding this vulnerability.