CVE-2023-45284: Incorrect detection of reserved device names on Windows in path/filepath

Severity: medium (CVSS 5.3 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.9% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2023-11-09 · updated 2026-06-17

Description

On Windows, The IsLocal function does not correctly detect reserved device names in some cases. Reserved names followed by spaces, such as "COM1 ", and reserved names "COM" and "LPT" followed by superscript 1, 2, or 3, are incorrectly reported as local. With fix, IsLocal now correctly reports these names as non-local.

Affected products

Go: before 1.20.11; from 1.21.0-0 before 1.21.4 — fixed in 1.20.11, 1.21.4

How to fix

Upgrade to a fixed version: Go 1.20.11, 1.21.4. Check the vendor advisory for mitigations.

References

https://go.dev/cl/540277
https://go.dev/issue/63713
https://groups.google.com/g/golang-announce/c/4tU8LZfBFkY
https://pkg.go.dev/vuln/GO-2023-2186
https://go.dev/cl/540277
https://go.dev/issue/63713
https://groups.google.com/g/golang-announce/c/4tU8LZfBFkY
https://pkg.go.dev/vuln/GO-2023-2186

Get alerted when CVE-2023-45284 or the next vulnerability affects your stack