CVE-2023-39320 Arbitrary code execution via go.mod toolchain directive in cmd/go

What is CVE-2023-39320?

CVE-2023-39320 is a critical code injection vulnerability in Golang Go, published on 8 Sep 2023. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

The go.mod toolchain directive, introduced in Go 1.21, can be leveraged to execute scripts and binaries relative to the root of the module when the "go" command was executed within the module. This applies to modules downloaded using the "go" command from the module proxy, as well as modules downloaded directly using VCS software.

Weakness: CWE-94

Which versions are affected by CVE-2023-39320?

2 open source packages ship an affected version, including golang and toolchain. It affects 1 product.

Products include Golang Go.

How do I fix CVE-2023-39320?

Upgrade golang to 1.21.1 or later.

Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.

Is CVE-2023-39320 being exploited?

There is no known exploitation of CVE-2023-39320 in the wild and no public exploit code.

Public exploit code: 1 proofs of concept on GitHub.

Other vulnerabilities in Golang Go

• CVE-2020-0601 Microsoft Windows CryptoAPI Spoofing Exploited High 8.1
• CVE-2026-27143 Missing bound checks can lead to memory corruption in safe Go in cmd/compile Critical 9.8
• CVE-2024-24790 Unexpected behavior from Is methods for IPv4-mapped IPv6 addresses in net/netip Critical 9.8
• CVE-2023-24540 Improper handling of JavaScript whitespace in html/template Critical 9.8
• CVE-2023-24538 Backticks not treated as string delimiters in html/template Critical 9.8

All Golang Go vulnerabilities

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as BELL-CVE-2023-39320, BIT-golang-2023-39320, GHSA-rxv8-v965-v333, GO-2023-2042.