Every CVE Search/ Get API key

CVE-2018-6574

Go before 1.8.7, Go 1.9.x before 1.9.4, and Go 1.10 pre-releases before Go 1.10rc2 allow "go get"...

7.8 HighPublic exploitFix available

CVE-2018-6574 is a high vulnerability (CVSS 7.8) in Golang Go, published February 7, 2018. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 7.62%, the 94th percentile. Fixed in go 1.9.4-r0.

Go before 1.8.7, Go 1.9.x before 1.9.4, and Go 1.10 pre-releases before Go 1.10rc2 allow "go get" remote command execution during source code build, by leveraging the gcc or clang plugin feature, because -fplugin= and -plugin= arguments were not blocked.

Attack profile

How easy it is to exploit

Attack vector
Local
Complexity
Low
Privileges needed
Low
User interaction
None

What an attacker can affect

Confidentiality
High
Integrity
High
Availability
High

Exploit likelihood

7.62%Down 6.8 points since Apr 14, 2021
90%50%10%1%

What each source reports

NVD Score used 7.8

Go before 1.8.7, Go 1.9.x before 1.9.4, and Go 1.10 pre-releases before Go 1.10rc2 allow "go get" remote command execution during source code build, by leveraging the gcc or clang plugin feature, because -fplugin= and -plugin= arguments were not blocked.

Record
CVE-2018-6574
CVSS 3.0
7.8 HighCVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS 2.0
4.6 MediumAV:L/AC:L/Au:N/C:P/I:P/A:P
Weakness
CWE-94
Updated
2026-11-02
CVE List No score

Go before 1.8.7, Go 1.9.x before 1.9.4, and Go 1.10 pre-releases before Go 1.10rc2 allow "go get" remote command execution during source code build, by leveraging the gcc or clang plugin feature, because -fplugin= and -plugin= arguments were not blocked.

Record
CVE-2018-6574
Updated
2026-11-02
EUVDEUVD-2018-18324 No score

Go before 1.8.7, Go 1.9.x before 1.9.4, and Go 1.10 pre-releases before Go 1.10rc2 allow "go get" remote command execution during source code build, by leveraging the gcc or clang plugin feature, because -fplugin= and -plugin= arguments were not blocked.

Record
EUVD-2018-18324
Updated
2026-11-03
GitHub AdvisoriesGHSA-c37c-qq99-c897 7.8

Go before 1.8.7, Go 1.9.x before 1.9.4, and Go 1.10 pre-releases before Go 1.10rc2 allow "go get"...

Go before 1.8.7, Go 1.9.x before 1.9.4, and Go 1.10 pre-releases before Go 1.10rc2 allow "go get" remote command execution during source code build, by leveraging the gcc or clang plugin feature, because -fplugin= and -plugin= arguments were not blocked.

Record
GHSA-c37c-qq99-c897
CVSS 3.0
7.8 HighCVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Weakness
CWE-94
Updated
2026-11-02
OSVALPINE-CVE-2018-6574 7.8

Go before 1.8.7, Go 1.9.x before 1.9.4, and Go 1.10 pre-releases before Go 1.10rc2 allow "go get" remote command execution during source code build, by leveraging the gcc or clang plugin feature, because -fplugin= and -plugin= arguments were not blocked.

Record
ALPINE-CVE-2018-6574
CVSS 3.0
7.8 HighCVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-03
OSVBELL-CVE-2018-6574 7.8

CVE-2018-6574 does not affect BellSoft software

Record
BELL-CVE-2018-6574
CVSS 3.0
7.8 HighCVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
Show 15 moreShow less
OSV 7.8

Go before 1.8.7, Go 1.9.x before 1.9.4, and Go 1.10 pre-releases before Go 1.10rc2 allow "go get" remote command execution during source code build, by leveraging the gcc or clang plugin feature, because -fplugin= and -plugin= arguments were not blocked.

Record
CVE-2018-6574
CVSS 3.0
7.8 HighCVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVRHSA-2018:0878 7.5

Red Hat Security Advisory: golang security, bug fix, and enhancement update

Record
RHSA-2018:0878
CVSS 3.0
7.5 HighCVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVRHSA-2018:1304 5.8

Red Hat Security Advisory: go-toolset-7 and go-toolset-7-golang security and bug fix update

Record
RHSA-2018:1304
CVSS 3.0
5.8 MediumCVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:L
Updated
2026-11-02
OSVUBUNTU-CVE-2018-6574 7.8

Go before 1.8.7, Go 1.9.x before 1.9.4, and Go 1.10 pre-releases before Go 1.10rc2 allow "go get" remote command execution during source code build, by leveraging the gcc or clang plugin feature, because -fplugin= and -plugin= arguments were not blocked.

Record
UBUNTU-CVE-2018-6574
CVSS 3.0
7.8 HighCVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVGO-2022-0201 No score

Remote command execution via "go get" command with cgo in cmd/go

The "go get" command with cgo is vulnerable to remote command execution by leveraging the gcc or clang plugin feature.

When cgo is enabled, the build step during "go get" invokes the host C compiler, gcc or clang, adding compiler flags specified in the Go source files. Both gcc and clang support a plugin mechanism in which a shared-library plugin is loaded into the compiler, as directed by compiler flags. This means that a Go package repository can contain an attack.so file along with a Go source file that says (for example) "// #cgo CFLAGS: -fplugin=attack.so" causing the attack plugin to be loaded into the host C compiler during the build. Gcc and clang plugins are completely unrestricted in their access to the host system.

Record
GO-2022-0201
Updated
2026-11-02
OSVMGASA-2018-0144 No score

Updated golang packages fix security vulnerability

Updated golang packages fix security vulnerabilities:

Go before 1.9.4 allows "go get" remote command execution during source code build, by leveraging the gcc or clang plugin feature, because -fplugin= and -plugin= arguments were not blocked (CVE-2018-6574).

Record
MGASA-2018-0144
Updated
2026-11-02
OSVopenSUSE-SU-2018:0588-1 No score

Security update for go

This update for go fixes the following issues:

Security issues fix in version 1.9.4:

  • CVE-2018-6574: 'go get' remote command execution during source code build (bsc#1080006).

Bug fixes:

  • bsc#1082409: Review dependencies (requires, recommends and supports).

This update was imported from the SUSE:SLE-12:Update update project.

Record
openSUSE-SU-2018:0588-1
Updated
2026-11-02
OSVopenSUSE-SU-2018:0589-1 No score

Security update for go

This update for go fixes the following issues:

Security issues fix in version 1.9.4:

  • CVE-2018-6574: 'go get' remote command execution during source code build (bsc#1080006).

Bug fixes:

  • bsc#1082409: Review dependencies (requires, recommends and supports).

This update was imported from the SUSE:SLE-12:Update update project.

Record
openSUSE-SU-2018:0589-1
Updated
2026-11-02
OSVopenSUSE-SU-2018:0628-1 No score

Security update for go1.8

This update for go1.8 fixes the following issues:

Security issues fixed:

  • CVE-2018-6574: 'go get' allows for remote command execution during source code build (bsc#1080006).

Bug fixes:

  • bsc#1082409: Review dependencies (requires, recommends and supports)

This update was imported from the SUSE:SLE-12:Update update project.

Record
openSUSE-SU-2018:0628-1
Updated
2026-11-02
OSVopenSUSE-SU-2018:0629-1 No score

Security update for go1.8

This update for go1.8 fixes the following issues:

Security issues fixed:

  • CVE-2018-6574: 'go get' allows for remote command execution during source code build (bsc#1080006).

Bug fixes:

  • bsc#1082409: Review dependencies (requires, recommends and supports)

This update was imported from the SUSE:SLE-12:Update update project.

Record
openSUSE-SU-2018:0629-1
Updated
2026-11-02
OSVopenSUSE-SU-2024:10802-1 No score

go-1.17-1.1 on GA media

These are all security issues fixed in the go-1.17-1.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2024:10802-1
Updated
2026-11-02
OSVopenSUSE-SU-2024:10803-1 No score

go1.10-1.10.8-8.2 on GA media

These are all security issues fixed in the go1.10-1.10.8-8.2 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2024:10803-1
Updated
2026-11-02
OSVopenSUSE-SU-2024:10804-1 No score

go1.11-1.11.13-10.5 on GA media

These are all security issues fixed in the go1.11-1.11.13-10.5 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2024:10804-1
Updated
2026-11-02
OSVopenSUSE-SU-2024:10805-1 No score

go1.12-1.12.17-4.8 on GA media

These are all security issues fixed in the go1.12-1.12.17-4.8 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2024:10805-1
Updated
2026-11-02
OSVopenSUSE-SU-2024:10812-1 No score

go1.9-1.9.7-11.2 on GA media

These are all security issues fixed in the go1.9-1.9.7-11.2 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2024:10812-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
go
Alpine:v3.10
 before 1.9.4-r0
1.9.4-r0
go
Alpine:v3.11
 before 1.9.4-r0
1.9.4-r0
go
Alpine:v3.12
 before 1.9.4-r0
1.9.4-r0
go
Alpine:v3.13
 before 1.9.4-r0
1.9.4-r0
go
Alpine:v3.14
 before 1.9.4-r0
1.9.4-r0
go
Alpine:v3.15
 before 1.9.4-r0
1.9.4-r0
go
Alpine:v3.16
 before 1.9.4-r0
1.9.4-r0
go
Alpine:v3.17
 before 1.9.4-r0
1.9.4-r0
go
Alpine:v3.18
 before 1.9.4-r0
1.9.4-r0
go
Alpine:v3.19
 before 1.9.4-r0
1.9.4-r0
Show 39 moreShow less
Affected packages
PackageAffectedFixed
go
Alpine:v3.20
 before 1.9.4-r0
1.9.4-r0
go
Alpine:v3.21
 before 1.9.4-r0
1.9.4-r0
go
Alpine:v3.22
 before 1.9.4-r0
1.9.4-r0
go
Alpine:v3.23
 before 1.9.4-r0
1.9.4-r0
go
Alpine:v3.24
 before 1.9.4-r0
1.9.4-r0
go
Alpine:v3.7
 before 1.9.4-r0
1.9.4-r0
go
Alpine:v3.8
 before 1.9.4-r0
1.9.4-r0
go
Alpine:v3.9
 before 1.9.4-r0
1.9.4-r0
go1.10
Alpine:v3.7
 before 1.9.4-r0
1.9.4-r0
golang-1.8
Debian:9
 before 1.8.1-1+deb9u1, plus listed versions
1.8.1-1
1.8.1-1+deb9u1
toolchain
Go
 before 1.8.7, 1.9.0-0 up to 1.9.4
1.8.71.9.4
golang
Mageia:6
 before 1.9.4-3.mga6
1.9.4-3.mga6
golang
Red Hat:enterprise_linux:7::server
 before 0:1.9.4-1.el7
0:1.9.4-1.el7
golang-bin
Red Hat:enterprise_linux:7::server
 before 0:1.9.4-1.el7
0:1.9.4-1.el7
golang-docs
Red Hat:enterprise_linux:7::server
 before 0:1.9.4-1.el7
0:1.9.4-1.el7
golang-misc
Red Hat:enterprise_linux:7::server
 before 0:1.9.4-1.el7
0:1.9.4-1.el7
golang-src
Red Hat:enterprise_linux:7::server
 before 0:1.9.4-1.el7
0:1.9.4-1.el7
golang-tests
Red Hat:enterprise_linux:7::server
 before 0:1.9.4-1.el7
0:1.9.4-1.el7
go-toolset-7
Red Hat:devtools:2018
 before 0:1.8-14.el7
0:1.8-14.el7
go-toolset-7-build
Red Hat:devtools:2018
 before 0:1.8-14.el7
0:1.8-14.el7
go-toolset-7-golang
Red Hat:devtools:2018
 before 0:1.8.7-2.el7
0:1.8.7-2.el7
go-toolset-7-golang-bin
Red Hat:devtools:2018
 before 0:1.8.7-2.el7
0:1.8.7-2.el7
go-toolset-7-golang-docs
Red Hat:devtools:2018
 before 0:1.8.7-2.el7
0:1.8.7-2.el7
go-toolset-7-golang-misc
Red Hat:devtools:2018
 before 0:1.8.7-2.el7
0:1.8.7-2.el7
go-toolset-7-golang-src
Red Hat:devtools:2018
 before 0:1.8.7-2.el7
0:1.8.7-2.el7
go-toolset-7-golang-tests
Red Hat:devtools:2018
 before 0:1.8.7-2.el7
0:1.8.7-2.el7
go-toolset-7-runtime
Red Hat:devtools:2018
 before 0:1.8-14.el7
0:1.8-14.el7
go-toolset-7-scldevel
Red Hat:devtools:2018
 before 0:1.8-14.el7
0:1.8-14.el7
go-toolset-7-golang-race
Red Hat:devtools:2018
 before 0:1.8.7-2.el7
0:1.8.7-2.el7
golang-1.6
Ubuntu:16.04:LTS
 All versions, plus listed versions
1.6-0ubuntu11.6-0ubuntu21.6-0ubuntu31.6-0ubuntu41.6-0ubuntu5
Show 5 moreShow less
1.6.1-0ubuntu11.6.2-0ubuntu5~16.041.6.2-0ubuntu5~16.04.21.6.2-0ubuntu5~16.04.31.6.2-0ubuntu5~16.04.4
 None known
golang-1.8
Ubuntu:18.04:LTS
 All versions, plus listed versions
1.8.3-2ubuntu11.8.3-2ubuntu1.18.04.1
 None known
go
SUSE:Package Hub 12
 before 1.9.4-15.1
1.9.4-15.1
go1.9
SUSE:Package Hub 12
 before 1.9.4-5.1
1.9.4-5.1
go1.8
SUSE:Package Hub 12
 before 1.8.7-5.1
1.8.7-5.1
go
openSUSE:Tumbleweed
 before 1.17-1.1
1.17-1.1
go1.10
openSUSE:Tumbleweed
 before 1.10.8-8.2
1.10.8-8.2
go1.11
openSUSE:Tumbleweed
 before 1.11.13-10.5
1.11.13-10.5
go1.12
openSUSE:Tumbleweed
 before 1.12.17-4.8
1.12.17-4.8
go1.9
openSUSE:Tumbleweed
 before 1.9.7-11.2
1.9.7-11.2

Public exploits

Links only. Every CVE stores no exploit code.

Public exploits
SourceLinkDate
PoC in GitHubacole76/cve-2018-65742018-04-02
PoC in GitHubneargle/Go-Get-RCE-CVE-2018-6574-POC2018-04-24
PoC in GitHubwb4r/go-get-rce2018-05-17
PoC in GitHubahmetmanga/cve-2018-65742018-05-20
PoC in GitHubahmetmanga/go-get-rce2018-05-20
PoC in GitHubredirected/cve-2018-65742018-11-01
PoC in GitHub20matan/CVE-2018-6574-POC2018-12-16
PoC in GitHubzur250/Zur-Go-GET-RCE-Solution2018-12-25
PoC in GitHubmekhalleh/cve-2018-65742018-12-30
PoC in GitHubveter069/go-get-rce2019-01-10
Show 15 moreShow less
Public exploits
SourceLinkDate
PoC in GitHubduckzsc2/CVE-2018-6574-POC2019-01-18
PoC in GitHubqweraqq/CVE-2018-65742019-04-08
PoC in GitHubd4rkshell/go-get-rce2019-04-19
PoC in GitHubchaosura/CVE-2018-65742019-05-16
PoC in GitHubfrench560/ptl65742019-07-22
PoC in GitHubInfoSecJack/CVE-2018-65742019-09-19
PoC in GitHubasavior2/CVE-2018-65742019-10-28
PoC in GitHubdrset/golang2019-11-29
PoC in GitHubfrozenkp/CVE-2018-65742019-12-02
PoC in GitHubkev-ho/cve-2018-6574-payload2020-01-02
PoC in GitHubsdosis/cve-2018-65742020-01-06
PoC in GitHubNo1zy/CVE-2018-6574-PoC2020-01-18
PoC in GitHubnthuong95/CVE-2018-65742020-03-04
PoC in GitHubAdriVillaB/CVE-2018-65742020-03-06
PoC in GitHubyitingfan/CVE-2018-6574_demo2020-03-16

Plus 66 more. The full list has every link.

History

History
WhenChangedSources
2026-11-03affected, aliases, referencesOSV
2026-11-03exploits, exploits_more
2026-11-03aliasesEUVD
2026-11-02createdCVE List, GitHub Advisories, NVD, OSV, PoC in GitHub

References

Show 51 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open