GO-2022-0190

Source
https://pkg.go.dev/vuln/GO-2022-0190
Import Source
https://vuln.go.dev/ID/GO-2022-0190.json
Aliases
Published
2022-08-02T15:44:23Z
Modified
2023-11-08T04:00:02.109573Z
Summary
Directory traversal via "go get" command in cmd/go
Details

The "go get" command is vulnerable to directory traversal when executed with the import path of a malicious Go package which contains curly brace (both '{' and '}' characters).

Specifically, it is only vulnerable in GOPATH mode, but not in module mode (the distinction is documented at https://golang.org/cmd/go/#hdr-Moduleawarego_get). The attacker can cause an arbitrary filesystem write, which can lead to code execution.

References

Affected packages

Go / toolchain

Package

Name
toolchain

Affected ranges

Type
SEMVER
Events
Introduced
0The exact introduced commit is unknown
Fixed
1.10.6
Introduced
1.11.0-0
Fixed
1.11.3

Ecosystem specific 

{
    "imports": [
        {
            "path": "cmd/go/internal/get",
            "symbols": [
                "downloadPackage"
            ]
        }
    ]
}