CVE-2023-24531
July 2, 2024, 8:15 p.m.
None
No Score
Description
Command go env is documented as outputting a shell script containing the Go environment. However, go env doesn't sanitize values, so executing its output as a shell script can cause various bad bahaviors, including executing arbitrary commands or inserting new environment variables. This issue is relatively minor because, in general, if an attacker can set arbitrary environment variables on a system, they have better attack vectors than making "go env" print them out.
Product(s) Impacted
| Product | Versions |
|---|---|
| Go programming language |
|
Weaknesses
Tags
Date
- Published: July 2, 2024, 8:15 p.m.
- Last Modified: July 2, 2024, 8:15 p.m.
Status : Received
CVE has been recently published to the CVE List and has been received by the NVD.
More infoSource
security@golang.org
*Disclaimer: Some vulnerabilities do not have an associated CPE. To enhance the data, we use AI to infer CPEs based on CVE details. This is an automated process and might not always be accurate.