https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Tue, 29 Sep 2026 15:44:08 +0000 https://vulnerability.circl.lu/vuln/cve-2018-16874 <p><strong>Affected:</strong> [UNKNOWN] golang</p> <p>In Go before 1.10.6 and 1.11.x before 1.11.3, the &#34;go get&#34; command is vulnerable to directory traversal when executed with the import path of a malicious Go package which contains curly braces (both &#39;{&#39; and &#39;}&#39; characters). Specifically, it is only vulnerable in GOPATH mode, but not in module mode (the distinction is documented at https://golang.org/cmd/go/#hdr-Module_aware_go_get). The attacker can cause an arbitrary filesystem write, which can lead to code execution.</p> <p><strong>Affected:</strong> [UNKNOWN] golang</p> <p>In Go before 1.10.6 and 1.11.x before 1.11.3, the &#34;go get&#34; command is vulnerable to directory traversal when executed with the import path of a malicious Go package which contains curly braces (both &#39;{&#39; and &#39;}&#39; characters). Specifically, it is only vulnerable in GOPATH mode, but not in module mode (the distinction is documented at https://golang.org/cmd/go/#hdr-Module_aware_go_get). The attacker can cause an arbitrary filesystem write, which can lead to code execution.</p> https://vulnerability.circl.lu/vuln/cve-2018-16874