Arbitrary Code Execution

2023-10-1205:25:05

Veracode Vulnerability Database

sca.analysiscenter.veracode.com

arbitrary code execution

vulnerability

iscgogeneratedfile

noder.go

github.com/golang/go

compiler flags

linker flags

0.002 Low

EPSS

Percentile

52.8%

JSON

github.com/golang/go is vulnerable to Arbitrary Code Execution. The vulnerability exists in the isCgoGeneratedFile function at noder.go due to line directives allowing blocked linker and compiler flags to be passed during compilation, which can result in arbitrary code execution when running go build.

CPENameOperatorVersion
github.com/golang/golego1.20.8
github.com/golang/golego1.19.13
go:edgeeq1.19.3-r0
go:edgeeq1.17.6-r0
go:edgeeq1.20.2-r0
go:edgeeq1.18.2-r0
go:edgeeq1.16-r0
go:edgeeq1.21.0-r0
go:edgeeq1.17.3-r0
go:edgeeq1.13.10-r0

Name	Operator	Version
github.com/golang/go	le	go1.20.8
github.com/golang/go	le	go1.19.13
go:edge	eq	1.19.3-r0
go:edge	eq	1.17.6-r0
go:edge	eq	1.20.2-r0
go:edge	eq	1.18.2-r0
go:edge	eq	1.16-r0
go:edge	eq	1.21.0-r0
go:edge	eq	1.17.3-r0
go:edge	eq	1.13.10-r0