Arbitrary code execution via go.mod toolchain directive in cmd/go

CVE-2023-39320

What is CVE-2023-39320?

The Go toolchain introduces a vulnerability that allows the execution of scripts and binaries relative to the root of a module. This is particularly concerning when executing the 'go' command within a module, as it affects modules downloaded from the module proxy and through version control system software. Exploiting this flaw may lead to unauthorized command execution, emphasizing the necessity for updating to secure versions and safeguarding project dependencies.

References