Vulnerability · Published Sep 8, 2023 · Assigned by Go
CVE-2023-39320Arbitrary code execution via go.mod toolchain directive in cmd/go
Critical 9.8
In plain English
A critical-severity security flaw in cmd/go from Go toolchain. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.8% (higher than 78% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code. Fixed versions are available - upgrade the affected package.
Official description
The go.mod toolchain directive, introduced in Go 1.21, can be leveraged to execute scripts and binaries relative to the root of the module when the "go" command was executed within the module. This applies to modules downloaded using the "go" command from the module proxy, as well as modules downloaded directly using VCS software.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine:v3.20 | go | 1.21.1-r0 | ALPINE-CVE-2023-39320 |
| Alpine:v3.21 | go | 1.21.1-r0 | ALPINE-CVE-2023-39320 |
| Alpine:v3.22 | go | 1.21.1-r0 | ALPINE-CVE-2023-39320 |
| Alpine:v3.23 | go | 1.21.1-r0 | ALPINE-CVE-2023-39320 |
| Alpine:v3.24 | go | 1.21.1-r0 | ALPINE-CVE-2023-39320 |
| Go | toolchain | 1.21.1 | GO-2023-2042 |
| Ubuntu:22.04:LTS | golang-1.21 | 1.21.1-1~ubuntu22.04.1 | UBUNTU-CVE-2023-39320 |
| Ubuntu:24.04:LTS | golang-1.21 | 1.21.5-1 | UBUNTU-CVE-2023-39320 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Go toolchain | cmd/go | 1.21.0-0 – before 1.21.1 |