{"resultsPerPage":1,"startIndex":0,"totalResults":1,"format":"NVD_CVE","version":"2.0","timestamp":"2026-04-21T13:20:24.650","vulnerabilities":[{"cve":{"id":"CVE-2023-39320","sourceIdentifier":"security@golang.org","published":"2023-09-08T17:15:27.977","lastModified":"2024-11-21T08:15:09.017","vulnStatus":"Modified","cveTags":[],"descriptions":[{"lang":"en","value":"The go.mod toolchain directive, introduced in Go 1.21, can be leveraged to execute scripts and binaries relative to the root of the module when the \"go\" command was executed within the module. This applies to modules downloaded using the \"go\" command from the module proxy, as well as modules downloaded directly using VCS software."},{"lang":"es","value":"La directiva de cadena de herramientas go.mod, introducida en Go 1.21, se puede aprovechar para ejecutar scripts y binarios relativos a la raíz del módulo cuando el comando \"go\" se ejecutó dentro del módulo. Esto se aplica a los módulos descargados utilizando el comando \"go\" desde el proxy del módulo, así como a los módulos descargados directamente mediante el software VCS."}],"metrics":{"cvssMetricV31":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","baseScore":9.8,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":3.9,"impactScore":5.9}]},"weaknesses":[{"source":"nvd@nist.gov","type":"Primary","description":[{"lang":"en","value":"CWE-94"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:golang:go:*:*:*:*:*:*:*:*","versionStartIncluding":"1.21.0","versionEndExcluding":"1.21.1","matchCriteriaId":"958E1BA0-2840-47E9-A790-79C10164C68C"}]}]}],"references":[{"url":"https://go.dev/cl/526158","source":"security@golang.org","tags":["Patch"]},{"url":"https://go.dev/issue/62198","source":"security@golang.org","tags":["Issue Tracking"]},{"url":"https://groups.google.com/g/golang-dev/c/2C5vbR-UNkI/m/L1hdrPhfBAAJ","source":"security@golang.org","tags":["Release Notes"]},{"url":"https://pkg.go.dev/vuln/GO-2023-2042","source":"security@golang.org","tags":["Vendor Advisory"]},{"url":"https://security.gentoo.org/glsa/202311-09","source":"security@golang.org"},{"url":"https://security.netapp.com/advisory/ntap-20231020-0004/","source":"security@golang.org","tags":["Third Party Advisory"]},{"url":"https://go.dev/cl/526158","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Patch"]},{"url":"https://go.dev/issue/62198","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Issue Tracking"]},{"url":"https://groups.google.com/g/golang-dev/c/2C5vbR-UNkI/m/L1hdrPhfBAAJ","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Release Notes"]},{"url":"https://pkg.go.dev/vuln/GO-2023-2042","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Vendor Advisory"]},{"url":"https://security.gentoo.org/glsa/202311-09","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://security.netapp.com/advisory/ntap-20231020-0004/","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Third Party Advisory"]}]}}]}