CVE-2018-16873: Go go get -u remote code execution via malicious import path

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 19 September 2026. Confidence: high.

high priorityCVSS 8.1 with high confidentiality, integrity and availability impact and a very high EPSS percentile, though exploitation requires the victim to run "go get -u" in GOPATH mode.

What it is

In Go before 1.10.6 and 1.11.x before 1.11.3, the "go get" command with the -u flag can be tricked into running attacker-controlled Git commands when fetching a malicious package or a package that imports it. A vanity import path ending in "/.git" causes a Git repository to be cloned into a folder named ".git", and a crafted config file in that repository root is then used as Git configuration, executing arbitrary commands. This matters because a routine dependency update can silently run attacker code on the developer or build machine.

Impact

An attacker gains arbitrary code execution with the privileges of the user running "go get -u", which on build or CI hosts can mean full compromise of the workspace and any credentials or artifacts it can reach.

Attack surface

Reached over the network when a developer or build system runs "go get -u" against a malicious import path or a package that transitively imports one; no authentication is required, but exploitation depends on the victim performing that fetch, and it only applies in GOPATH mode, not module mode.

Exploitation

Not listed in CISA KEV and no ransomware associations are recorded, but EPSS is high (0.66252, 99.2nd percentile), indicating substantial predicted exploitation activity; references are advisories, mailing lists and a Gentoo mitigation note, with no public exploit tag.

What to do

• Upgrade Go to 1.10.6, 1.11.3 or later, and rebuild any tooling or images that bundle an older toolchain.
• Apply the vendor updates referenced by the SUSE, openSUSE and Debian advisories for packaged Go.
• Avoid running "go get -u" in GOPATH mode against untrusted or unvetted import paths; prefer module mode where the flaw does not apply.
• Restrict outbound access from build and CI hosts so they cannot fetch arbitrary external Git repositories.
• Run dependency fetches in a sandboxed, low-privilege environment without access to production credentials.

Detection

• Monitor build and CI hosts for "go get -u" invocations and for Git processes spawned by Go tooling.
• Alert on Git repositories or clones containing a ".git" directory whose parent also holds HEAD, config, objects and refs entries.
• Inspect Git config files in fetched repositories for hooks or aliases that execute shell commands.
• Watch for unexpected outbound Git or HTTP fetches from developer and build machines to unfamiliar vanity import domains.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.