CVE-2018-7187
HighRemote command execution via "go get" command with "-insecure" option in cmd/go
Published Aug 9, 2022 · Updated Jul 8, 2026 · Also known as DEBIAN-CVE-2018-7187, DLA-1294-1, DSA-4379-1, GO-2022-0203, UBUNTU-CVE-2018-7187
Key Facts
Patch immediately- CVE-2018-7187 is a high-severity vulnerability (CVSS 8.8 v3.1) affecting Go (Golang), Debian Linux, golang-1.7 (debian) and 22 more products.
- It is not listed in any known-exploited vulnerabilities catalog. No public exploit code is known.
- EPSS estimates a 63% probability of exploitation in the next 30 days.
- Fixed versions are available, including containerd 1.1.2-5.3.4, containerd 1.1.2-lp150.4.3.1, containerd-ctr 1.1.2-lp150.4.3.1.
- Brandefense priority: patch immediately, because it is very likely to be exploited soon.
CVSS v3.1
8.8
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
EPSS (30-day exploit likelihood)
63%
Higher than 99.1% of all scored CVEs
Exploited in the wild
No known
Not in a known-exploited catalog
Public exploit code
None known
Get the full CVE-2018-7187 brief as a PDF
Every affected product and fixed release, exploitation status and a first 24 hours response checklist, emailed within minutes.
Description
The "go get" implementation in Go 1.9.4, when the -insecure command-line option is used, does not validate the import path (get/vcs.go only checks for "://" anywhere in the string), which allows remote attackers to execute arbitrary OS commands via a crafted web site.
Affected Products
76 affected entries in total| Product | Affected versions | Fixed in |
|---|---|---|
| GoGolang | See advisory | 1.9.5 |
| Debian LinuxDebian | 7.0, 9.0 | n/a |
| golang-1.7debian | See advisory | 1.7.4-2+deb9u1 |
| golang-1.8debian | See advisory | 1.8.1-1+deb9u1 |
| golangdebian | See advisory | 2:1.0.2-1.1+deb7u3 |
Patched Releases
containerd
1.1.2-5.3.4, 1.1.2-lp150.4.3.1
containerd-ctr
1.1.2-lp150.4.3.1
containerd-kubic
1.1.2-lp150.4.3.1
containerd-kubic-ctr
1.1.2-lp150.4.3.1
containerd-kubic-test
1.1.2-lp150.4.3.1
containerd-test
1.1.2-lp150.4.3.1
docker
18.06.1_ce-6.8.2, 18.06.1_ce-lp150.5.6.1
docker-bash-completion
18.06.1_ce-6.8.2, 18.06.1_ce-lp150.5.6.1
docker-kubic
18.06.1_ce-lp150.5.6.1
docker-kubic-bash-completion
18.06.1_ce-lp150.5.6.1
docker-kubic-test
18.06.1_ce-lp150.5.6.1
docker-kubic-zsh-completion
18.06.1_ce-lp150.5.6.1
docker-libnetwork
0.7.0.1+gitr2664_3ac297bc7fd0-4.3.5, 0.7.0.1+gitr2664_3ac297bc7fd0-lp150.3.3.1
docker-libnetwork-kubic
0.7.0.1+gitr2664_3ac297bc7fd0-lp150.3.3.1
docker-runc
1.0.0rc5+gitr3562_69663f0bd4b6-6.3.4, 1.0.0rc5+gitr3562_69663f0bd4b6-lp150.5.3.1
docker-runc-kubic
1.0.0rc5+gitr3562_69663f0bd4b6-lp150.5.3.1
docker-runc-kubic-test
1.0.0rc5+gitr3562_69663f0bd4b6-lp150.5.3.1
docker-runc-test
1.0.0rc5+gitr3562_69663f0bd4b6-lp150.5.3.1
docker-test
18.06.1_ce-lp150.5.6.1
docker-zsh-completion
18.06.1_ce-lp150.5.6.1
Go
1.10.4-bp150.2.3.1, 1.10.4-lp150.2.7.1, 1.17-1.1, 1.9.4-2.ph1, 1.9.4-2.ph2, 1.9.7-19.1, NA, 1.9.5
go-doc
1.10.4-bp150.2.3.1, 1.10.4-lp150.2.7.1, 1.17-1.1, 1.9.7-19.1
go-race
1.10.4-bp150.2.3.1, 1.10.4-lp150.2.7.1, 1.17-1.1, 1.9.7-19.1
go1.10
1.10.7-bp150.2.1, 1.10.7-lp150.2.1
go1.10-doc
1.10.7-bp150.2.1, 1.10.7-lp150.2.1
Timeline
Publicly disclosed
Aug 9, 2022
Last updated
Jul 8, 2026
Weakness Type
- CWE-20 Improper Input Validation
- CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
References
- advisoryhttps://bugzilla.suse.com/1047218
- advisoryhttps://bugzilla.suse.com/1074971
- advisoryhttps://bugzilla.suse.com/1080978
- advisoryhttps://bugzilla.suse.com/1081495
- advisoryhttps://bugzilla.suse.com/1084533
FAQ
Common Questions.
The "go get" implementation in Go 1.9.4, when the -insecure command-line option is used, does not validate the import path (get/vcs.go only checks for "://" anywhere in the string), which allows remote attackers to execute arbitrary OS commands via a crafted web site.
Affected: Go (Golang); Debian Linux versions 7.0, 9.0; golang-1.7 (debian), among others. The full list is in the CVE brief.
It is not listed in any known-exploited vulnerabilities catalog.
No, it is not currently listed in the CISA Known Exploited Vulnerabilities catalog.
No public exploit code is known.
Fixed versions are available, including containerd 1.1.2-5.3.4, containerd 1.1.2-lp150.4.3.1, containerd-ctr 1.1.2-lp150.4.3.1.
Brandefense priority: patch immediately, because it is very likely to be exploited soon.
Is CVE-2018-7187 Running On Your Attack Surface?
Brandefense maps vulnerabilities like this one to your internet-facing assets and tells you exactly where to patch.
Request A Demo