Skip to content
Fencer Intel
high 8.8

CVE-2018-7187 in the critical feed json

Remote command execution via "go get" command with "-insecure" option in cmd/go

published 8y ago modified 4mo ago also GO-2022-0203 , EUVD-2018-18929

cvss
8.8
version 3.1, NVD
cisa kev
Not listed
not in CISA's catalog
epss
63.0%
EPSS 63.0% chance of exploitation in 30 days, percentile 99.2%
public exploits
0
none known

Summary

The "go get" implementation in Go 1.9.4, when the -insecure command-line option is used, does not validate the import path (get/vcs.go only checks for "://" anywhere in the string), which allows remote attackers to execute arbitrary OS commands via a crafted web site.

Patch / fix

  • go toolchain 1.9.5, 1.10.1
  • golang go 1.9.5, 1.10.1
  • docker SLE Module for Containers 15 18.06.1_ce-6.8.2
  • containerd SLE Module for Containers 15 1.1.2-5.3.4
  • docker-runc SLE Module for Containers 15 1.0.0rc5+gitr3562_69663f0bd4b6-6.3.4
  • golang-github-docker-libnetwork SLE Module for Containers 15 0.7.0.1+gitr2664_3ac297bc7fd0-4.3.5

suse advisories SUSE-SU-2018:4297-1

  • go openSUSE Tumbleweed 1.17-1.1
  • go1.9 openSUSE Tumbleweed 1.9.7-11.2
  • go Package Hub 15 1.10.4-bp150.2.3.1
  • go1.10 Package Hub 15 1.10.7-bp150.2.1
  • golang-packaging Package Hub 15 15.0.11-bp150.3.3.1

opensuse advisories openSUSE-SU-2024:10802-1openSUSE-SU-2024:10812-1openSUSE-SU-2018:4302-1

Is CVE-2018-7187 in your dependencies? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.

Check with Fencer

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2018-7187 updated cvss 7.1

golang: arbitrary command execution via VCS path

  • Red Hat Enterprise Linux 7 golang, golang-bin, golang-src, golang-misc, golang-tests
    affected: no fix planned “Will not fix”
  • Red Hat OpenShift Enterprise 3 golang
    affected: no fix available
  • Red Hat OpenStack Platform 8 (Liberty) Operational Tools golang, golang-src, golang-pkg-linux-amd64, golang-pkg-bin-linux-amd64 Red Hat OpenStack Platform 9 (Mitaka) Operational Tools golang, golang-bin, golang-src
    affected: no fix planned “Will not fix”
  • Red Hat Ceph Storage 2 golang, golang-bin, golang-src Red Hat Ceph Storage 3 golang, golang-bin, golang-src Red Hat Enterprise Linux 8 golang, go-toolset, golang-bin, golang-src, golang-misc, golang-race, +1 more Red Hat Storage 3 golang, golang-bin, golang-src, golang-misc, golang-tests
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

Exploit prediction

63.03% chance of exploitation in the next 30 days, higher than 99.2% of all scored CVEs (FIRST EPSS, 2026-11-09).

Exploits and checks

  • github.com https://github.com/golang/go/issues/23867 referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by version score vector
NVD 3.1 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
NVD 2.0 9.3 AV:N/AC:M/Au:N/C:C/I:C/A:C

Affected packages

ecosystem package affected fixed in
go toolchain
<1.9.5
>=1.10.0-0, <1.10.1
1.9.5
1.10.1

Classification

Weakness
  • CWE-78 Improper Neutralization of Special Elements used in an OS Command

References

Sources

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.