CVE-2023-39320

The go.mod toolchain directive, introduced in Go 1.21, can be leveraged to execute scripts and binaries relative to the root of the module when the "go" command was executed within the module. This applies to modules downloaded using the "go" command from the module proxy, as well as modules downloaded directly using VCS software.

• CWE-94

• https://go.dev/cl/526158Patch
• https://go.dev/issue/62198Issue Tracking
• https://groups.google.com/g/golang-dev/c/2C5vbR-UNkI/m/L1hdrPhfBAAJRelease Notes
• https://pkg.go.dev/vuln/GO-2023-2042Vendor Advisory
• https://security.gentoo.org/glsa/202311-09
• https://security.netapp.com/advisory/ntap-20231020-0004/Third Party Advisory
• https://go.dev/cl/526158Patch
• https://go.dev/issue/62198Issue Tracking
• https://groups.google.com/g/golang-dev/c/2C5vbR-UNkI/m/L1hdrPhfBAAJRelease Notes
• https://pkg.go.dev/vuln/GO-2023-2042Vendor Advisory
• https://security.gentoo.org/glsa/202311-09
• https://security.netapp.com/advisory/ntap-20231020-0004/Third Party Advisory

Published

Sep 8, 2023

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2023-39314Unauth. Reflected Cross-Site Scripting (XSS) vulnerability i…6.1
• CVE-2023-39316Multiple integer overflow vulnerabilities exist in the LXT2 …7.8
• CVE-2023-39317Multiple integer overflow vulnerabilities exist in the LXT2 …7.8
• CVE-2023-39318The html/template package does not properly handle HTML-like…6.1
• CVE-2023-39319The html/template package does not apply the proper rules fo…6.1
• CVE-2023-3932An issue has been discovered in GitLab EE affecting all vers…6.5
• CVE-2023-39321Processing an incomplete post-handshake message for a QUIC c…7.5
• CVE-2023-39322QUIC connections do not set an upper bound on the amount of …7.5
• CVE-2023-39323Line directives ("//line") can be used to bypass the restric…8.1
• CVE-2023-39324Rejected reason: reserved but not needed
• CVE-2023-39325A malicious HTTP/2 client which rapidly creates requests and…7.5
• CVE-2023-39326A malicious HTTP sender can use chunk extensions to cause a …5.3