What’s Vulnerable › Vulnerabilities

CVE-2023-24531: Output of "go env" does not sanitize values in cmd/go

• Severity: critical (CVSS 9.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.8% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2024-07-02 · updated 2026-06-17

Description

Command go env is documented as outputting a shell script containing the Go environment. However, go env doesn't sanitize values, so executing its output as a shell script can cause various bad bahaviors, including executing arbitrary commands or inserting new environment variables. This issue is relatively minor because, in general, if an attacker can set arbitrary environment variables on a system, they have better attack vectors than making "go env" print them out.

Affected products

• Gotoolchain Cmd/Go: before 1.21.0-0 — fixed in 1.21.0-0

How to fix

Upgrade to a fixed version: Gotoolchain Cmd/Go 1.21.0-0. Check the vendor advisory for mitigations.

References

• https://go.dev/cl/488375
• https://go.dev/cl/493535
• https://go.dev/issue/58508
• https://groups.google.com/g/golang-dev/c/ixHOFpSbajE/m/8EjlbKVWAwAJ
• https://pkg.go.dev/vuln/GO-2024-2962
• https://go.dev/cl/488375
• https://go.dev/cl/493535
• https://go.dev/issue/58508
• https://groups.google.com/g/golang-dev/c/ixHOFpSbajE/m/8EjlbKVWAwAJ
• https://pkg.go.dev/vuln/GO-2024-2962
• https://security.netapp.com/advisory/ntap-20250328-0005/

Get alerted when CVE-2023-24531 or the next vulnerability affects your stack