CVE-2018-7187
The "go get" implementation in Go 1.9.4, when the -insecure command-line option is used, does not...
CVE-2018-7187 is a high vulnerability (CVSS 8.8) in Golang Go, published February 16, 2018. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 63.0%, the 99th percentile. Fixed in golang 2:1.0.2-1.1+deb7u3.
The "go get" implementation in Go 1.9.4, when the -insecure command-line option is used, does not validate the import path (get/vcs.go only checks for "://" anywhere in the string), which allows remote attackers to execute arbitrary OS commands via a crafted web site.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- Required
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
NVD Score used
The "go get" implementation in Go 1.9.4, when the -insecure command-line option is used, does not validate the import path (get/vcs.go only checks for "://" anywhere in the string), which allows remote attackers to execute arbitrary OS commands via a crafted web site.
- Record
CVE-2018-7187- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - CVSS 2.0
- 9.3 High
AV:N/AC:M/Au:N/C:C/I:C/A:C - Weakness
- CWE-78
- Updated
- 2026-11-02
CVE List No score
The "go get" implementation in Go 1.9.4, when the -insecure command-line option is used, does not validate the import path (get/vcs.go only checks for "://" anywhere in the string), which allows remote attackers to execute arbitrary OS commands via a crafted web site.
- Record
CVE-2018-7187- Updated
- 2026-11-02
EUVDEUVD-2018-18929 No score
The "go get" implementation in Go 1.9.4, when the -insecure command-line option is used, does not validate the import path (get/vcs.go only checks for "://" anywhere in the string), which allows remote attackers to execute arbitrary OS commands via a crafted web site.
- Record
EUVD-2018-18929- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-44r2-v58f-9q85
The "go get" implementation in Go 1.9.4, when the -insecure command-line option is used, does not...
The "go get" implementation in Go 1.9.4, when the -insecure command-line option is used, does not validate the import path (get/vcs.go only checks for "://" anywhere in the string), which allows remote attackers to execute arbitrary OS commands via a crafted web site.
- Record
GHSA-44r2-v58f-9q85- CVSS 3.0
- 8.8 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Weakness
- CWE-78
- Updated
- 2026-11-02
OSV
The "go get" implementation in Go 1.9.4, when the -insecure command-line option is used, does not validate the import path (get/vcs.go only checks for "://" anywhere in the string), which allows remote attackers to execute arbitrary OS commands via a crafted web site.
- Record
CVE-2018-7187- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVUBUNTU-CVE-2018-7187
The "go get" implementation in Go 1.9.4, when the -insecure command-line option is used, does not validate the import path (get/vcs.go only checks for "://" anywhere in the string), which allows remote attackers to execute arbitrary OS commands via a crafted web site.
- Record
UBUNTU-CVE-2018-7187- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
Show 6 moreShow less
OSVGO-2022-0203 No score
Remote command execution via "go get" command with "-insecure" option in cmd/go
The "go get" command is vulnerable to remote code execution.
When the -insecure command-line option is used, "go get" does not validate the import path (get/vcs.go only checks for "://" anywhere in the string), which allows remote attackers to execute arbitrary OS commands via a crafted web site.
- Record
GO-2022-0203- Updated
- 2026-11-02
OSVMGASA-2018-0238 No score
Updated golang packages fix security vulnerability
A flaw was found in Go Lang. The "go get" implementation in Go 1.9.4, when the -insecure command-line option is used, does not validate the import path (get/vcs.go only checks for "://" anywhere in the string), which allows remote attackers to execute arbitrary OS commands via a crafted web site (CVE-2018-7187)
- Record
MGASA-2018-0238- Updated
- 2026-11-02
OSVopenSUSE-SU-2018:4302-1 No score
Security update for go
This update for go fixes the following issues:
- golang: arbitrary command execution via VCS path (bsc#1081495, CVE-2018-7187)
- Make profile.d/go.sh no longer set GOROOT=, in order to make switching between versions no longer break. This ends up removing the need for go.sh entirely (because GOPATH is also set automatically) (boo#1119634)
- Fix a regression that broke go get for import path patterns containing '...' (bsc#1119706)
Additionally, the package go1.10 has been added.
This update was imported from the SUSE:SLE-15:Update update project.
- Record
openSUSE-SU-2018:4302-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:10802-1 No score
go-1.17-1.1 on GA media
These are all security issues fixed in the go-1.17-1.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:10802-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:10812-1 No score
go1.9-1.9.7-11.2 on GA media
These are all security issues fixed in the go1.9-1.9.7-11.2 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:10812-1- Updated
- 2026-11-02
OSVSUSE-SU-2018:4297-1 No score
Security update for containerd, docker and go
This update for containerd, docker and go fixes the following issues:
containerd and docker:
- Add backport for building containerd (bsc#1102522, bsc#1113313)
- Upgrade to containerd v1.1.2, which is required for Docker v18.06.1-ce. (bsc#1102522)
- Enable seccomp support on SLE12 (fate#325877)
- Update to containerd v1.1.1, which is the required version for the Docker v18.06.0-ce upgrade. (bsc#1102522)
- Put containerd under the podruntime slice (bsc#1086185)
- 3rd party registries used the default Docker certificate (bsc#1084533)
- Handle build breakage due to missing 'export GOPATH' (caused by resolution of boo#1119634). I believe Docker is one of the only packages with this problem.
go:
- golang: arbitrary command execution via VCS path (bsc#1081495, CVE-2018-7187)
- Make profile.d/go.sh no longer set GOROOT=, in order to make switching between versions no longer break. This ends up removing the need for go.sh entirely (because GOPATH is also set automatically) (boo#1119634)
- Fix a regression that broke go get for import path patterns containing '...' (bsc#1119706)
Additionally, the package go1.10 has been added.
- Record
SUSE-SU-2018:4297-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
golangDebian:7 |
before 2:1.0.2-1.1+deb7u3, plus listed versions 2:1.0.2-1.12:1.0.2-1.1+deb7u12:1.0.2-1.1+deb7u2 |
2:1.0.2-1.1+deb7u3 |
golang-1.7Debian:9 |
before 1.7.4-2+deb9u1, plus listed versions 1.7.4-2 |
1.7.4-2+deb9u1 |
golang-1.8Debian:9 |
before 1.8.1-1+deb9u1, plus listed versions 1.8.1-1 |
1.8.1-1+deb9u1 |
toolchainGo |
before 1.9.5, 1.10.0-0 up to 1.10.1 | 1.9.51.10.1 |
golangMageia:6 |
before 1.9.4-4.mga6 | 1.9.4-4.mga6 |
containerdSUSE:Linux Enterprise Module for Containers 15 |
before 1.1.2-5.3.4 | 1.1.2-5.3.4 |
dockerSUSE:Linux Enterprise Module for Containers 15 |
before 18.06.1_ce-6.8.2 | 18.06.1_ce-6.8.2 |
docker-runcSUSE:Linux Enterprise Module for Containers 15 |
before 1.0.0rc5+gitr3562_69663f0bd4b6-6.3.4 | 1.0.0rc5+gitr3562_69663f0bd4b6-6.3.4 |
golang-github-docker-libnetworkSUSE:Linux Enterprise Module for Containers 15 |
before 0.7.0.1+gitr2664_3ac297bc7fd0-4.3.5 | 0.7.0.1+gitr2664_3ac297bc7fd0-4.3.5 |
golang-1.6Ubuntu:16.04:LTS |
All versions, plus listed versions 1.6-0ubuntu11.6-0ubuntu21.6-0ubuntu31.6-0ubuntu41.6-0ubuntu5 Show 5 moreShow less1.6.1-0ubuntu11.6.2-0ubuntu5~16.041.6.2-0ubuntu5~16.04.21.6.2-0ubuntu5~16.04.31.6.2-0ubuntu5~16.04.4 |
None known |
Show 6 moreShow less
| Package | Affected | Fixed |
|---|---|---|
golang-1.9Ubuntu:18.04:LTS |
All versions, plus listed versions 1.9.1-2ubuntu11.9.2-1ubuntu11.9.2-3ubuntu11.9.3-1ubuntu11.9.4-1ubuntu1 |
None known |
goSUSE:Package Hub 15 |
before 1.10.4-bp150.2.3.1 | 1.10.4-bp150.2.3.1 |
go1.10SUSE:Package Hub 15 |
before 1.10.7-bp150.2.1 | 1.10.7-bp150.2.1 |
golang-packagingSUSE:Package Hub 15 |
before 15.0.11-bp150.3.3.1 | 15.0.11-bp150.3.3.1 |
goopenSUSE:Tumbleweed |
before 1.17-1.1 | 1.17-1.1 |
go1.9openSUSE:Tumbleweed |
before 1.9.7-11.2 | 1.9.7-11.2 |
History
| When | Changed | Sources |
|---|---|---|
| 2026-11-03 | aliases | EUVD |
| 2026-11-02 | created | CVE List, GitHub Advisories, NVD, OSV |
References
lists.debian.org/debian-lts-announce/2018/02/msg00029.html
debian.org/security/2019/dsa-4380
security.gentoo.org/glsa/201804-12
github.com/golang/go/issues/23867
gist.github.com/SLAYEROWNER/b2a358f13ab267f2e9543bb9f9320ffc
Show 47 moreShow less
nvd.nist.gov/vuln/detail/CVE-2018-7187
go.dev/cl/94603
go.googlesource.com/go/+/c941e27e70c3e06e1011d2dd71d72a7a06a9bcbc
groups.google.com/g/golang-announce/c/IkPkOF8JqLs/m/TFBbWHJYAwAJ
advisories.mageia.org/MGASA-2018-0238.html
bugs.mageia.org/show_bug.cgi?id=22812
lists.fedoraproject.org/archives/list/[email protected]/thread/BZKVEAK5ZG3B4FJLZVMX3HIQ73RHC4VW
suse.com/support/update/announcement/2018/suse-su-20184297-1
bugzilla.suse.com/1047218
ubuntu.com/security/CVE-2018-7187
cve.org/CVERecord?id=CVE-2018-7187
lists.opensuse.org/archives/list/[email protected]/thread/PZCRXEXMCF6XFL7IRZ3SXSULVBU2CDJD