In Go before 1.10.6 and 1.11.x before 1.11.3, the "go get" command is vulnerable to directory traversal when executed with the import path of a malicious Go package which contains curly braces (both '{' and '}' characters). Specifically, it is only vulnerable in GOPATH mode, but not in module mode (the distinction is documented at https://golang.org/cmd/go/#hdr-Module_aware_go_get). The attacker can cause an arbitrary filesystem write, which can lead to code execution.
CVSS Details
- CVSS 3.1 Base Score: 8.1
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H)
- CVSS 3.0 Base Score: 6.8
- CVSS 3.0 Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Amazon_linux | — | Upgrade golang | Mar 2, 2020 | Dec 14, 2018 |
| Arch Linux | — | Upgrade to the latest version of Arch Linux | Jul 11, 2025 | Dec 14, 2018 |
| Debian | — | Upgrade golang-1.11 | Mar 15, 2021 | Dec 14, 2018 |
| Gentoo Linux | — | Upgrade dev-lang/go. | Dec 21, 2018 | Dec 14, 2018 |
| Huawei Euleros 2_0_sp8 | — | Upgrade golang-binUpgrade golangUpgrade golang-src | Jan 3, 2020 | Dec 14, 2018 |
| Oracle Solaris | — | Upgrade system/library/gcc/gcc-gobjc-runtime-9 to version 9.2.0-11.4.21.0.1.69.0 on Solaris 11.4Upgrade system/library/gcc/gcc-gfortran-runtime-9 to version 9.2.0-11.4.21.0.1.69.0 on Solaris 11.4Upgrade system/library/gcc/gcc-go-runtime to version 9.2.0-11.4.21.0.1.69.0 on Solaris 11.4Upgrade system/library/gcc/gcc-c-runtime-9 to version 9.2.0-11.4.21.0.1.69.0 on Solaris 11.4Upgrade system/library/gcc/gcc-runtime to version 9.2.0-11.4.21.0.1.69.0 on Solaris 11.4Upgrade developer/gcc/gcc-go-9 to version 9.2.0-11.4.21.0.1.69.0 on Solaris 11.4Upgrade developer/gcc/gcc-c-9 to version 9.2.0-11.4.21.0.1.69.0 on Solaris 11.4Upgrade developer/gcc/gcc-go to version 9.2.0-11.4.21.0.1.69.0 on Solaris 11.4Upgrade system/library/gcc/gcc-runtime-9 to version 9.2.0-11.4.21.0.1.69.0 on Solaris 11.4Upgrade developer/gcc/gcc-gfortran to version 9.2.0-11.4.21.0.1.69.0 on Solaris 11.4Upgrade developer/gcc/gcc-gobjc to version 9.2.0-11.4.21.0.1.69.0 on Solaris 11.4Upgrade developer/gcc-9 to version 9.2.0-11.4.21.0.1.69.0 on Solaris 11.4Upgrade developer/gcc/gcc-gfortran-9 to version 9.2.0-11.4.21.0.1.69.0 on Solaris 11.4Upgrade developer/gcc/gcc-common-9 to version 9.2.0-11.4.21.0.1.69.0 on Solaris 11.4Upgrade system/library/gcc/gcc-gfortran-runtime to version 9.2.0-11.4.21.0.1.69.0 on Solaris 11.4Upgrade developer/gcc/gcc-c++ to version 9.2.0-11.4.21.0.1.69.0 on Solaris 11.4Upgrade system/library/gcc/gcc-gobjc-runtime to version 9.2.0-11.4.21.0.1.69.0 on Solaris 11.4Upgrade system/library/gcc/gcc-c-runtime to version 9.2.0-11.4.21.0.1.69.0 on Solaris 11.4Upgrade developer/gcc/gcc-gobjc-9 to version 9.2.0-11.4.21.0.1.69.0 on Solaris 11.4Upgrade developer/gcc to version 9.2.0-11.4.21.0.1.69.0 on Solaris 11.4Upgrade system/library/gcc/gcc-go-runtime-9 to version 9.2.0-11.4.21.0.1.69.0 on Solaris 11.4 | Jan 19, 2021 | Dec 14, 2018 |
| Redhat_linux | — | No solution exists | Jul 9, 2025 | Dec 14, 2018 |
| Suse | — | Upgrade go1.10-docUpgrade docker-fish-completionUpgrade go1.11-docUpgrade docker-runc-kubic-testUpgrade go-docUpgrade docker-kubic-testUpgrade containerd-ctrUpgrade golang-packagingUpgrade kubernetes-controller-managerUpgrade kubernetes-masterUpgrade go1.12-docUpgrade kubernetes-kubelet-commonUpgrade go1.11Upgrade containerd-testUpgrade dockerUpgrade golang-github-docker-libnetworkUpgrade golang-github-docker-libnetwork-kubicUpgrade containerd-kubic-testUpgrade docker-libnetwork-kubicUpgrade go1.12-raceUpgrade kubernetes-kubeadmUpgrade cri-oUpgrade docker-bash-completionUpgrade go1.14-raceUpgrade cri-toolsUpgrade kubernetes-kubelet1.17Upgrade docker-kubicUpgrade kubernetes-clientUpgrade go1.11-raceUpgrade go1.10Upgrade go-raceUpgrade containerd-kubic-ctrUpgrade goUpgrade kubernetes-apiserverUpgrade kubernetes-kubelet1.18Upgrade runcUpgrade docker-runc-testUpgrade helm-mirrorUpgrade docker-libnetworkUpgrade go1.10-raceUpgrade runc-testUpgrade go1.14-docUpgrade docker-testUpgrade cri-o-kubeadm-criconfigUpgrade helmUpgrade kubernetes-nodeUpgrade docker-kubic-zsh-completionUpgrade kubernetes-schedulerUpgrade go1.14Upgrade containerdUpgrade go1.12Upgrade docker-runc-kubicUpgrade docker-zsh-completionUpgrade docker-kubic-bash-completionUpgrade containerd-kubicUpgrade kubernetes-proxyUpgrade docker-runc | Dec 20, 2018 | Dec 14, 2018 |
| Ubuntu | — | No solution exists | Jun 26, 2025 | Dec 14, 2018 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | Dec 14, 2018 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub