CVE-2023-39320 Arbitrary code execution via go.mod toolchain directive in cmd/go

2023-09-0816:13:26

www.cve.org

cve-2023-39320

arbitrary code execution

go.mod toolchain

cmd/go

module proxy

vcs software

9.8 High

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

48.6%

JSON

The go.mod toolchain directive, introduced in Go 1.21, can be leveraged to execute scripts and binaries relative to the root of the module when the “go” command was executed within the module. This applies to modules downloaded using the “go” command from the module proxy, as well as modules downloaded directly using VCS software.

CNA Affected

[
  {
    "vendor": "Go toolchain",
    "product": "cmd/go",
    "collectionURL": "https://pkg.go.dev",
    "packageName": "cmd/go",
    "versions": [
      {
        "version": "1.21.0-0",
        "lessThan": "1.21.1",
        "status": "affected",
        "versionType": "semver"
      }
    ],
    "defaultStatus": "unaffected"
  }
]