CVE-2023-29402

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

The go command may generate unexpected code at build time when using cgo. This may result in unexpected behavior when running a go program which uses cgo. This may occur when running an untrusted module which contains directories with newline characters in their names. Modules which are retrieved using the go command, i.e. via "go get", are not affected (modules retrieved using GOPATH-mode, i.e. GO111MODULE=off, may be affected).

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-94

Affected software

Vendor	Product	Versions
Go toolchain	cmd/go	< 1.19.10; >= 1.20.0-0, < 1.20.5

References

Timeline

Published: Jun 8, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-294037.8On Unix platforms, the Go runtime does not behave differently when a binary is run with the setuid/setgid bits. This can be dangerous in cer CVE-2023-294049.8The go command may execute arbitrary code at build time when using cgo. This may occur when running "go get" on a malicious module, or when CVE-2023-294059.8The go command may execute arbitrary code at build time when using cgo. This may occur when running "go get" on a malicious module, or when CVE-2023-294066.5The HTTP/1 client does not fully validate the contents of the Host header. A maliciously crafted Host header can inject additional headers o CVE-2023-294076.5A maliciously-crafted image can cause excessive CPU consumption in decoding. A tiled image with a height of 0 and a very large width can cau CVE-2023-294086.5The TIFF decoder does not place a limit on the size of compressed tile data. A maliciously-crafted image can exploit this to cause a small i CVE-2023-294095.3Extremely large RSA keys in certificate chains can cause a client/server to expend significant CPU time verifying signatures. With fix, the CVE-2023-29414.3Inappropriate implementation in Extensions API in Google Chrome prior to 114.0.5735.90 allowed an attacker who convinced a user to install a CVE-2023-294108.8A CWE-20: Improper Input Validation vulnerability exists that could allow an authenticated attacker to gain the same privilege as the applic CVE-2023-294119.8A CWE-306: Missing Authentication for Critical Function vulnerability exists that could allow changes to administrative credentials, leading CVE-2023-294129.8CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability exists that could cause rem CVE-2023-294137.5A CWE-306: Missing Authentication for Critical Function vulnerability exists that could cause Denial-of-Service when accessed by an unauthen