CVE-2023-24531 - CVE House

Back to Database

Status published Unknown CVE-2023-24531

Output of "go env" does not sanitize values in cmd/go

0 CVSS

Vulnerability Description

Command go env is documented as outputting a shell script containing the Go environment. However, go env doesn't sanitize values, so executing its output as a shell script can cause various bad bahaviors, including executing arbitrary commands or inserting new environment variables. This issue is relatively minor because, in general, if an attacker can set arbitrary environment variables on a system, they have better attack vectors than making "go env" print them out.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2023-24531

Check My Exposure

Credits & Attribution

The following person or organization is credited with identifying this vulnerability, as recorded in the NVD database:

Hunter Wittenborn (https://hunterwittenborn.com/)

References

More from Go toolchain

View All →

Unexpected code execution when invoking toolchain in cmd/go

Potential code smuggling via doc comments in cmd/cgo

Arbitrary file write using cgo pkg-config directive in cmd/go

Unexpected command execution in untrusted VCS repositories in cmd/go

Arbitrary code execution during build on darwin in cmd/go

Affected Vendor

Go toolchain

View all reports →

Affected Software

cmd/go

Vulnerable Versions:

0

Timeline

Official Publish: July 2nd, 2024

Last Modified: March 28th, 2025

Added to House: July 22nd, 2026

CVSS Vectors

No vector data available

Weaknesses (CWE)

No CWE data available

MITRE ATT&CK TTPs

No associated TTPs found for this vulnerability.