CVE-2023-39320

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2023-39320
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2023-39320.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2023-39320
Aliases
Downstream
Related
Published
2023-09-08T16:13:26Z
Modified
2026-08-12T03:51:08Z
Summary
Arbitrary code execution via go.mod toolchain directive in cmd/go
Details

The go.mod toolchain directive, introduced in Go 1.21, can be leveraged to execute scripts and binaries relative to the root of the module when the "go" command was executed within the module. This applies to modules downloaded using the "go" command from the module proxy, as well as modules downloaded directly using VCS software.

Database specific 
{
    "cna_assigner": "Go",
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/39xxx/CVE-2023-39320.json",
    "unresolved_ranges": [
        {
            "extracted_events": [
                {
                    "introduced": "1.21.0-0"
                },
                {
                    "fixed": "1.21.1"
                }
            ],
            "source": "AFFECTED_FIELD"
        }
    ]
}
References

Affected packages

Git / github.com/golang/go

Affected ranges

Type
GIT
Repo
https://github.com/golang/go
Events
Introduced
c19c4c566c63818dfd059b352e52c4710eecf14d
Fixed
2c1e5b05fe39fc5e6c730dd60e82946b8e67c6ba
Database specific
Show details 
{
    "cpe": "cpe:2.3:a:golang:go:*:*:*:*:*:*:*:*",
    "extracted_events": [
        {
            "introduced": "1.21.0"
        },
        {
            "fixed": "1.21.1"
        }
    ],
    "source": "CPE_RANGE"
}

Affected versions

go1.*
go1.21.0

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2023-39320.json"