cve.bz

CVE-2023-39323

8.1 highEPSS 1.9%

High (8.1). EPSS 1.9% chance of exploitation in the next 30 days. Fixed in toolchain 1.20.9, 1.21.2.

Line directives ("//line") can be used to bypass the restrictions on "//go:cgo_" directives, allowing blocked linker and compiler flags to be passed during compilation. This can result in unexpected execution of arbitrary code when running "go build". The line directive requires the absolute path of the file in which the directive lives, which makes exploiting this issue significantly more complex.

Severity

CVSS 3.1

8.1 high
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS
1.9% chance of exploitation in the next 30 days; higher than 79% of CVEs (scores of 2026-10-31)
Published
Modified
Record from
the NVD, synced

Affected

Packages (OSV)

AdvisoryEcosystemPackageAffectedFixed in
GO-2023-2095Gotoolchain<1.20.9
>=1.21.0-0 <1.21.2		1.20.9, 1.21.2

References

Check your stackJSON