https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Tue, 29 Sep 2026 19:11:51 +0000 https://vulnerability.circl.lu/vuln/cve-2018-16873 <p><strong>Affected:</strong> [UNKNOWN] golang</p> <p>In Go before 1.10.6 and 1.11.x before 1.11.3, the &#34;go get&#34; command is vulnerable to remote code execution when executed with the -u flag and the import path of a malicious Go package, or a package that imports it directly or indirectly. Specifically, it is only vulnerable in GOPATH mode, but not in module mode (the distinction is documented at https://golang.org/cmd/go/#hdr-Module_aware_go_get). Using custom domains, it&#39;s possible to arrange things so that a Git repository is cloned to a folder named &#34;.git&#34; by using a vanity import path that ends with &#34;/.git&#34;. If the Git repository root contains a &#34;HEAD&#34; file, a &#34;config&#34; file, an &#34;objects&#34; directory, a &#34;refs&#34; directory, with some work to ensure the proper ordering of operations, &#34;go get -u&#34; can be tricked into considering the parent directory as a repository root, and running Git commands on it. That will use the &#34;config&#34; file in the original Git repository root for its configuration, and if that config file contains malicious commands, they will execute on the system running &#34;go get -u&#34;.</p> <p><strong>Affected:</strong> [UNKNOWN] golang</p> <p>In Go before 1.10.6 and 1.11.x before 1.11.3, the &#34;go get&#34; command is vulnerable to remote code execution when executed with the -u flag and the import path of a malicious Go package, or a package that imports it directly or indirectly. Specifically, it is only vulnerable in GOPATH mode, but not in module mode (the distinction is documented at https://golang.org/cmd/go/#hdr-Module_aware_go_get). Using custom domains, it&#39;s possible to arrange things so that a Git repository is cloned to a folder named &#34;.git&#34; by using a vanity import path that ends with &#34;/.git&#34;. If the Git repository root contains a &#34;HEAD&#34; file, a &#34;config&#34; file, an &#34;objects&#34; directory, a &#34;refs&#34; directory, with some work to ensure the proper ordering of operations, &#34;go get -u&#34; can be tricked into considering the parent directory as a repository root, and running Git commands on it. That will use the &#34;config&#34; file in the original Git repository root for its configuration, and if that config file contains malicious commands, they will execute on the system running &#34;go get -u&#34;.</p> https://vulnerability.circl.lu/vuln/cve-2018-16873