CVE-2023-24531

Command go env is documented as outputting a shell script containing the Go
environment. However, go env doesn’t sanitize values, so executing its
output as a shell script can cause various bad bahaviors, including
executing arbitrary commands or inserting new environment variables. This
issue is relatively minor because, in general, if an attacker can set
arbitrary environment variables on a system, they have better attack
vectors than making “go env” print them out.

Notes