SWIG file names that contain the substring 'cgo' and specially crafted payloads can be processed by the Go toolchain during SWIG code generation. This bypasses expected trust checks and allows the embedded code to be compiled and executed as part of the build. As a result, an attacker who can influence the contents or names of SWIG files can inject malicious code that runs with the privileges of the build process, compromising confidentiality, integrity, or availability of the built binaries. The weakness is a code‑smuggling scenario, related to CWE‑641 and CWE‑863.

The vulnerability applies to the Go toolchain component cmd/go used by developers and build systems. No specific version information is supplied, so all releases of the Go toolchain that include the vulnerable SWIG handling path are potentially affected. This includes any environment where Go is used to compile projects that incorporate SWIG modules.

The CVSS score of 8.8 indicates a high‑severity attack that is likely exploitable locally during a build. The EPSS score of less than 1% suggests that a large number of real-world exploits are not publicly available, and the vulnerability is not listed in CISA's KEV catalog. Nevertheless, an attacker who gains the ability to supply or modify SWIG files can execute arbitrary code at build time, so the risk is significant if the build environment is compromised or if untrusted code is compiled.