CVE-2018-16874: Debian Linux

High severity, CVSS 8.1. EPSS: 5% chance of exploitation in the next 30 days.

In Go before 1.10.6 and 1.11.x before 1.11.3, the "go get" command is vulnerable to directory traversal when executed with the import path of a malicious Go package which contains curly braces (both '{' and '}' characters). Specifically, it is only vulnerable in GOPATH mode, but not in module mode (the distinction is documented at https://golang.org/cmd/go/#hdr-Module_aware_go_get). The attacker can cause an arbitrary filesystem write, which can lead to code execution.

Affected products

• Debian Debian Linux: version 9.0 only
• Golang Go: before 1.10.6 (fixed in 1.10.6); from 1.11.0, before 1.11.3 (fixed in 1.11.3)
• Opensuse Backports Sle: version 15.0 only
• Opensuse Leap: version 15.0 only; version 15.1 only; version 42.3 only
• Suse Linux Enterprise Server: version 12 only

Published 2018-12-14. Last modified 2026-06-17.