Google Go Code Injection Vulnerability

🗓️ 08 Sep 2023 00:00:00Reported by China National Vulnerability Database of Information SecurityType

cnnvd

cnnvd🔗 www.cnnvd.org.cn👁 1 Views

Code injection in Google Go 1.21 allows executing scripts and binaries from the module root via a toolchain directive.

Reporter	Title	Published	Views	Family All 72
IBM Security Bulletins	Security Bulletin: Operations Dashboard is vulnerable to remote code execution due to Go	15 Nov 202313:35	–	ibm
IBM Security Bulletins	Security Bulletin: Vulnerabilities in Node.js, Golang Go, HTTP/2, NGINX, OpenSSH, Linux kernel might affect IBM Spectrum Protect Plus	4 Feb 202518:15	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Watson Discovery for IBM Cloud Pak for Data affected by vulnerability in Go	5 Jun 202420:46	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple vulnerabilities in IBM Spectrum Protect Plus Container backup and restore for Kubernetes and OpenShift	15 Apr 202502:37	–	ibm
IBM Security Bulletins	Security Bulletin: Platform Navigator and Automation Assets in IBM Cloud Pak for Integration are vulnerable to code injection and privilege escalation due to multiple vulnerabilities in Go	30 Oct 202316:16	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Cloud Pak for Data Scheduling contains a vulnerable yq package. [CVE-2023-39320, CVE-2023-39321 and CVE-2023-39322]	18 Mar 202414:18	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple Vulnerabilities in IBM Cloud Pak for Multicloud Management	25 Sep 202417:28	–	ibm
AlpineLinux	CVE-2023-39320	8 Sep 202316:13	–	alpinelinux
BDU FSTEC	The vulnerability of the go.mod file in the Go programming language allows a hacker to elevate their privileges and execute arbitrary code.	16 Sep 202300:00	–	bdu_fstec
FreeBSD	go -- multiple vulnerabilities	6 Sep 202300:00	–	freebsd

Source	Link
go	www.go.dev/cl/526158
go	www.go.dev/issue/62198
groups	www.groups.google.com/g/golang-dev/c/2C5vbR-UNkI/m/L1hdrPhfBAAJ
pkg	www.pkg.go.dev/vuln/GO-2023-2042
security	www.security.netapp.com/advisory/ntap-20231020-0004/
cxsecurity	www.cxsecurity.com/cveshow/CVE-2023-39320/
auscert	www.auscert.org.au/bulletins/ESB-2023.6869

16 Jan 2026 00:00Current

7High risk

Vulners AI Score7

CVSS 3.19.8

EPSS0.00798

SSVC

google go version 1.21 toolchain directive module root code injection security vulnerability