Go 1.21 Toolchain RCE via go.mod
CVE-2023-39320 Published on September 8, 2023
Arbitrary code execution via go.mod toolchain directive in cmd/go
The go.mod toolchain directive, introduced in Go 1.21, can be leveraged to execute scripts and binaries relative to the root of the module when the "go" command was executed within the module. This applies to modules downloaded using the "go" command from the module proxy, as well as modules downloaded directly using VCS software.
Products Associated with CVE-2023-39320
Want to know whenever a new CVE is published for GoLang Go? stack.watch will email you.
Affected Versions
Go toolchain cmd/go:- Version 1.21.0-0 and below 1.21.1 is affected.
Exploit Probability
EPSS (Exploit Prediction Scoring System) scores estimate the probability that a vulnerability will be exploited in the wild within the next 30 days. The percentile shows you how this score compares to all other vulnerabilities.