In Go before 1.10.6 and 1.11.x before 1.11.3, the "go get" command is vulnerable to directory traversal when executed with the import path of a malicious Go package which contains curly braces (both '{' and '}' characters). Specifically, it is only vulnerable in GOPATH mode, but not in module mode (the distinction is documented at https://golang.org/cmd/go/#hdr-Module_aware_go_get). The attacker can cause an arbitrary filesystem write, which can lead to code execution.
CVSS Details
- CVSS 3.1 Base Score: 8.1
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H)
- CVSS 3.0 Base Score: 6.8
- CVSS 3.0 Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Amazon_linux | — | Upgrade golang | Mar 2, 2020 | Dec 14, 2018 |
| Arch Linux | — | Upgrade to the latest version of Arch Linux | Jul 11, 2025 | Dec 14, 2018 |
| Debian | — | Upgrade golang-1.11 | Mar 15, 2021 | Dec 14, 2018 |
| Gentoo Linux | — | Upgrade dev-lang/go. | Dec 21, 2018 | Dec 14, 2018 |
| Huawei Euleros 2_0_sp8 | — | Upgrade golang-srcUpgrade golangUpgrade golang-bin | Jan 3, 2020 | Dec 14, 2018 |
| Oracle Solaris | — | Upgrade developer/gcc-9 to version 9.2.0-11.4.21.0.1.69.0 on Solaris 11.4Upgrade developer/gcc/gcc-go to version 9.2.0-11.4.21.0.1.69.0 on Solaris 11.4Upgrade system/library/gcc/gcc-runtime to version 9.2.0-11.4.21.0.1.69.0 on Solaris 11.4Upgrade developer/gcc/gcc-c-9 to version 9.2.0-11.4.21.0.1.69.0 on Solaris 11.4Upgrade developer/gcc/gcc-go-9 to version 9.2.0-11.4.21.0.1.69.0 on Solaris 11.4Upgrade developer/gcc/gcc-gfortran to version 9.2.0-11.4.21.0.1.69.0 on Solaris 11.4Upgrade system/library/gcc/gcc-go-runtime to version 9.2.0-11.4.21.0.1.69.0 on Solaris 11.4Upgrade system/library/gcc/gcc-runtime-9 to version 9.2.0-11.4.21.0.1.69.0 on Solaris 11.4Upgrade developer/gcc/gcc-gobjc to version 9.2.0-11.4.21.0.1.69.0 on Solaris 11.4Upgrade developer/gcc/gcc-gfortran-9 to version 9.2.0-11.4.21.0.1.69.0 on Solaris 11.4Upgrade system/library/gcc/gcc-c-runtime-9 to version 9.2.0-11.4.21.0.1.69.0 on Solaris 11.4Upgrade system/library/gcc/gcc-c-runtime to version 9.2.0-11.4.21.0.1.69.0 on Solaris 11.4Upgrade developer/gcc to version 9.2.0-11.4.21.0.1.69.0 on Solaris 11.4Upgrade system/library/gcc/gcc-gfortran-runtime-9 to version 9.2.0-11.4.21.0.1.69.0 on Solaris 11.4Upgrade system/library/gcc/gcc-gfortran-runtime to version 9.2.0-11.4.21.0.1.69.0 on Solaris 11.4Upgrade system/library/gcc/gcc-go-runtime-9 to version 9.2.0-11.4.21.0.1.69.0 on Solaris 11.4Upgrade system/library/gcc/gcc-gobjc-runtime-9 to version 9.2.0-11.4.21.0.1.69.0 on Solaris 11.4Upgrade system/library/gcc/gcc-gobjc-runtime to version 9.2.0-11.4.21.0.1.69.0 on Solaris 11.4Upgrade developer/gcc/gcc-common-9 to version 9.2.0-11.4.21.0.1.69.0 on Solaris 11.4Upgrade developer/gcc/gcc-c++ to version 9.2.0-11.4.21.0.1.69.0 on Solaris 11.4Upgrade developer/gcc/gcc-gobjc-9 to version 9.2.0-11.4.21.0.1.69.0 on Solaris 11.4 | Jan 19, 2021 | Dec 14, 2018 |
| Redhat_linux | — | No solution exists | Jul 9, 2025 | Dec 14, 2018 |
| Suse | — | Upgrade containerdUpgrade containerd-kubic-ctrUpgrade docker-runc-testUpgrade docker-kubic-zsh-completionUpgrade helmUpgrade containerd-kubicUpgrade kubernetes-proxyUpgrade docker-runcUpgrade kubernetes-schedulerUpgrade go1.14Upgrade runc-testUpgrade go1.14-docUpgrade docker-testUpgrade helm-mirrorUpgrade docker-runc-kubicUpgrade docker-kubic-bash-completionUpgrade kubernetes-apiserverUpgrade docker-zsh-completionUpgrade go-raceUpgrade kubernetes-kubelet1.18Upgrade goUpgrade go1.10-raceUpgrade docker-libnetworkUpgrade runcUpgrade kubernetes-nodeUpgrade cri-o-kubeadm-criconfigUpgrade go1.12Upgrade go1.12-raceUpgrade cri-toolsUpgrade kubernetes-clientUpgrade kubernetes-masterUpgrade go1.11-docUpgrade go1.14-raceUpgrade go1.10-docUpgrade docker-fish-completionUpgrade containerd-kubic-testUpgrade go1.10Upgrade docker-bash-completionUpgrade kubernetes-controller-managerUpgrade docker-kubic-testUpgrade go-docUpgrade docker-kubicUpgrade containerd-ctrUpgrade golang-packagingUpgrade kubernetes-kubelet1.17Upgrade kubernetes-kubelet-commonUpgrade golang-github-docker-libnetwork-kubicUpgrade containerd-testUpgrade go1.12-docUpgrade go1.11Upgrade go1.11-raceUpgrade dockerUpgrade kubernetes-kubeadmUpgrade cri-oUpgrade golang-github-docker-libnetworkUpgrade docker-runc-kubic-testUpgrade docker-libnetwork-kubic | Dec 20, 2018 | Dec 14, 2018 |
| Ubuntu | — | No solution exists | Jun 26, 2025 | Dec 14, 2018 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | Dec 14, 2018 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub