CVE-2018-7187: Go 'go get' -insecure option allows OS command injection via unvalidated import path

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 19 September 2026. Confidence: high.

high priorityCVSS 8.8 with network reachability and high EPSS plus a public exploit reference, though exploitation requires the victim to run 'go get -insecure'.

What it is

The 'go get' implementation in Go 1.9.4, when the -insecure command-line option is used, fails to validate the import path; get/vcs.go only checks for '://' anywhere in the string. A crafted web site can supply a malicious import path that leads to arbitrary OS command execution. This matters because developers running 'go get -insecure' against attacker-influenced input can have their machine compromised.

Impact

An attacker can execute arbitrary operating system commands on the machine of a user who runs 'go get -insecure' with a crafted import path, leading to full compromise of that host under the user's privileges.

Attack surface

Reached remotely over the network (AV:N) with no privileges required (PR:N), but exploitation requires user interaction (UI:R) because the victim must run 'go get -insecure' against the crafted import path, typically delivered via a malicious web site.

Exploitation

CISA KEV does not list this CVE, but EPSS is high (0.63027, 99.164th percentile) and the GitHub issue reference is tagged 'Exploit', indicating public exploit material exists.

What to do

• Upgrade Go to a version that validates the import path in get/vcs.go; apply the vendor patch for Go 1.9.4 and later fixed releases.
• Apply the Debian and Gentoo security updates (DSA-4379, DSA-4380, GLSA 201804-12) on affected Linux distributions.
• Avoid using the 'go get -insecure' option; remove it from build scripts and developer workflows.
• Restrict or block outbound 'go get' fetches to untrusted import paths at the network or proxy level.
• Educate developers not to run 'go get -insecure' against import paths from untrusted or web-sourced input.

Detection

• Monitor process command lines for 'go get' invocations that include the '-insecure' flag.
• Alert on child processes spawned by 'go get' that execute shells or unexpected system commands.
• Review network egress from developer/build hosts for fetches to untrusted VCS or import path hosts.
• Audit build and CI logs for '-insecure' usage and unusual import path strings containing '://'.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.