CVE-2023-24531

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

Command go env is documented as outputting a shell script containing the Go environment. However, go env doesn't sanitize values, so executing its output as a shell script can cause various bad bahaviors, including executing arbitrary commands or inserting new environment variables. This issue is relatively minor because, in general, if an attacker can set arbitrary environment variables on a system, they have better attack vectors than making "go env" print them out.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected software

No affected versions have been published.

Timeline

Published: Jul 2, 2024
Last modified: Jun 17, 2026
NVD status: Deferred

Related CVEs from 2023

CVE-2023-245325.3The ScalarMult and ScalarBaseMult methods of the P256 Curve may return an incorrect result if called with some specific unreduced scalars (a CVE-2023-245337.5Multiplication of certain unreduced P-256 scalars produce incorrect results. There are no protocols known at this time that can be attacked CVE-2023-245347.5HTTP and MIME header parsing can allocate large amounts of memory, even when parsing small inputs, potentially leading to a denial of servic CVE-2023-245357.5Parsing invalid messages can panic. Parsing a text-format message which contains a potential number consisting of a minus sign, one or more CVE-2023-245367.5Multipart form parsing can consume large amounts of CPU and memory when processing form inputs containing very large numbers of parts. This CVE-2023-245377.5Calling any of the Parse functions on Go source code which contains //line directives with very large line numbers can cause an infinite loo CVE-2023-245389.8Templates do not properly consider backticks (`) as Javascript string delimiters, and do not escape them as expected. Backticks are used, si CVE-2023-245397.3Angle brackets (<>) are not considered dangerous characters when inserted into CSS contexts. Templates containing multiple actions separated CVE-2023-24547.2schema_element defeats protective search_path changes; It was found that certain database calls in PostgreSQL could permit an authed attacke CVE-2023-245409.8Not all valid JavaScript whitespace characters are considered to be whitespace. Templates containing whitespace characters outside of the ch CVE-2023-245426.7Unquoted search path or element in some Intel(R) Thunderbolt(TM) DCH drivers for Windows before version 88 may allow an authenticated user t CVE-2023-245448.1Improper access control vulnerability in Buffalo network devices allows a network-adjacent attacker to obtain specific files of the product.