CVE-2018-6574

Go before 1.8.7, Go 1.9.x before 1.9.4, and Go 1.10 pre-releases before Go 1.10rc2 allow "go get" remote command execution during source code build, by leveraging the gcc or clang plugin feature, because -fplugin= and -plugin= arguments were not blocked.

• CWE-94

• https://access.redhat.com/errata/RHSA-2018:0878Third Party Advisory
• https://access.redhat.com/errata/RHSA-2018:1304Third Party Advisory
• https://github.com/KINGSABRI/CVE-in-Ruby/tree/master/CVE-2018-6574Exploit, Third Party Advisory
• https://github.com/golang/go/issues/23672Issue Tracking, Third Party Advisory
• https://groups.google.com/forum/#%21topic/golang-nuts/Gbhh1NxAjMU
• https://groups.google.com/forum/#%21topic/golang-nuts/sprOaQ5m3Dk
• https://www.debian.org/security/2019/dsa-4380Third Party Advisory
• https://access.redhat.com/errata/RHSA-2018:0878Third Party Advisory
• https://access.redhat.com/errata/RHSA-2018:1304Third Party Advisory
• https://github.com/KINGSABRI/CVE-in-Ruby/tree/master/CVE-2018-6574Exploit, Third Party Advisory
• https://github.com/golang/go/issues/23672Issue Tracking, Third Party Advisory
• https://groups.google.com/forum/#%21topic/golang-nuts/Gbhh1NxAjMU
• https://groups.google.com/forum/#%21topic/golang-nuts/sprOaQ5m3Dk
• https://www.debian.org/security/2019/dsa-4380Third Party Advisory

Published

Feb 7, 2018

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2018-6559The Linux kernel, as used in Ubuntu 18.04 LTS and Ubuntu 18.…
• CVE-2018-6560In dbus-proxy/flatpak-proxy.c in Flatpak before 0.8.9, and 0…
• CVE-2018-6561dijit.Editor in Dojo Toolkit 1.13 allows XSS via the onload …
• CVE-2018-6562totemomail Encryption Gateway before 6.0_b567 allows remote …
• CVE-2018-6563Multiple cross-site request forgery (CSRF) vulnerabilities i…
• CVE-2018-6569West Wind Web Server 6.x does not require authentication for…
• CVE-2018-6575SQL Injection exists in the JEXTN Classified 1.0.0 component…
• CVE-2018-6576SQL Injection exists in Event Manager 1.0 via the event.php …
• CVE-2018-6577SQL Injection exists in the JEXTN Membership 3.1.0 component…
• CVE-2018-6578SQL Injection exists in the JE PayperVideo 3.0.0 component f…
• CVE-2018-6579SQL Injection exists in the JEXTN Reverse Auction 3.1.0 comp…
• CVE-2018-6580Arbitrary file upload exists in the Jimtawl 2.1.6 and 2.2.5 …