Not rated
CVE-2023-39320 The go.mod toolchain directive, introduced in Go 1.21, can be leveraged to execute scripts and binaries relative to…
Description
The go.mod toolchain directive, introduced in Go 1.21, can be leveraged to execute scripts and binaries relative to the root of the module when the "go" command was executed within the module. This applies to modules downloaded using the "go" command from the module proxy, as well as modules downloaded directly using VCS software.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| cmd/go 1.21 | 1.21.0-0 → < 1.21.1 | 1.21.1 |
Other CVEs of cmd/go
The 23 CVEs of cmd/go →
CVE-2026-94444
Previously, a user operating inside of a malicious Go project that defines a bogus golang.org/fips140 and operates a…
7.8
High
CVE-2026-94447
Previously, a user operating inside of a malicious Go project that defines a bogus golang.org/toolchain go.sum entry and…
7.8
High
CVE-2026-56865
A malicious GOPROXY was previously capable of forging up to two sumdb tiles that allow for a requested module to…
8.4
High
CVE-2026-56864
A malicious GOSUMDB was capable of serving arbitrary module content not contained within the transparency log
7.5
High