CVE-2023-39320 — Code Injection in Toolchain CMD GO

CWE-94 — Code Injection6 documents5 sources
Severity
9.8CRITICALNVD
EPSS
0.8%
top 25.94%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
GO Toolchain CMD GOGolang GO
Timeline
PublishedSep 8

Description

The go.mod toolchain directive, introduced in Go 1.21, can be leveraged to execute scripts and binaries relative to the root of the module when the "go" command was executed within the module. This applies to modules downloaded using the "go" command from the module proxy, as well as modules downloaded directly using VCS software.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HExploitability: 3.9 | Impact: 5.9

Affected Packages2 packages

▶CVEListV5go_toolchain/cmd_go1.21.0-0 — 1.21.1
▶NVDgolang/go1.21.0 — 1.21.1

Patches

Patch: go.dev ↗Patch: go.dev ↗

🔴Vulnerability Details

4
OSV
CVE-2023-39320: The go↗2023-09-08
▶
CVEList
Arbitrary code execution via go.mod toolchain directive in cmd/go↗2023-09-08
▶
GHSA
GHSA-rxv8-v965-v333: The go↗2023-09-08
▶
OSV
Arbitrary code execution via go.mod toolchain directive in cmd/go↗2023-09-07
▶

📋Vendor Advisories

1
Red Hat
golang: cmd/go: go.mod toolchain directive allows arbitrary execution↗2023-09-06
▶
CVE-2023-39320 — Code Injection in GO Toolchain CMD GO | cvebase