CVE-2025-22867

Name of the Vulnerable Software and Affected Versions: go versions 1.24rc2

Description: The issue is related to building a Go module that contains CGO on Darwin. It can trigger arbitrary code execution when using the Apple version of ld. This is due to the usage of special values @executable path, @loader path, or @rpath in a "#cgo LDFLAGS" directive.

Recommendations: For go version 1.24rc2, consider avoiding the use of the Apple version of ld or refrain from using the special values @executable path, @loader path, or @rpath in the "#cgo LDFLAGS" directive until a patch is available. As a temporary workaround, consider disabling the CGO functionality in the Go module to prevent potential arbitrary code execution.