Remote command execution via "go get" command with cgo in cmd/go

Also known as GO-2022-0201

Published 8 y ago 2018-02-07 · modified 4 mo ago 2026-06-17 · JSON

CVSS

7.8

v3.0 · NVD

CISA KEV

not known exploited

EPSS

7.6%

percentile 95%

Public exploits

none known

Go before 1.8.7, Go 1.9.x before 1.9.4, and Go 1.10 pre-releases before Go 1.10rc2 allow "go get" remote command execution during source code build, by leveraging the gcc or clang plugin feature, because -fplugin= and -plugin= arguments were not blocked.

Exploit prediction (EPSS)

7.63% probability of exploitation in the next 30 days, higher than 95% of all scored CVEs.

CVSS scores

Assigned by	Version	Score	Vector
NVD	3.0	7.8	`CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H`
NVD	2.0	4.6	`AV:L/AC:L/Au:N/C:P/I:P/A:P`

Affected packages

Ecosystem	Package	Affected	Fixed in
go	`toolchain`	<1.8.7 >=1.9.0-0, <1.9.4	1.8.7 1.9.4

Classification

Weakness

CWE-94 Improper Control of Generation of Code

References

access.redhat.com /errata/RHSA-2018:1304 · vendor-advisory, x_refsource_REDHAT, x_transferred
access.redhat.com /errata/RHSA-2018:0878 · vendor-advisory, x_refsource_REDHAT, x_transferred
debian.org /security/2019/dsa-4380 · vendor-advisory, x_refsource_DEBIAN, x_transferred
github.com /KINGSABRI/CVE-in-Ruby/tree/master/CVE-2018-6574 · x_refsource_MISC, x_transferred
groups.google.com /forum/#%21topic/golang-nuts/sprOaQ5m3Dk · x_refsource_CONFIRM, x_transferred
github.com /golang/go/issues/23672 · x_refsource_CONFIRM, x_transferred
groups.google.com /forum/#%21topic/golang-nuts/Gbhh1NxAjMU · x_refsource_CONFIRM, x_transferred
go.googlesource.com /go/+/1dcb5836ad2c60776561da2923c70576ba2eefc6 · fix
go.dev /issue/23672 · report
groups.google.com /g/golang-nuts/c/Gbhh1NxAjMU · web

Sources

vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.