| Package | Affected versions | Patched versions |
|---|---|---|
| toolchain | ≥ 1.10.0-0, < 1.10.1< 1.9.5 | 1.10.11.9.5 |
| go | ≥ 1.10, < 1.10.1< 1.9.5 | 1.10.11.9.5 |
The "go get" command is vulnerable to remote code execution.
When the -insecure command-line option is used, "go get" does not validate the import path (get/vcs.go only checks for "://" anywhere in the string), which allows remote attackers to execute arbitrary OS commands via a crafted web site.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free