A malicious module proxy can bypass the Go command’s checksum database validation by returning an empty or unrelated checksum entry. Because the go tool only relies on the checksum database when a module is not listed in go.sum, a missing entry is incorrectly accepted, allowing an attacker to supply an altered toolchain module. The resulting malicious toolchain can be executed during a build or version switch, giving the attacker arbitrary code execution in the user’s environment.

This vulnerability applies to the Go toolchain’s cmd/go component when the user selects a different Go toolchain version—through the GOTOOLCHAIN environment variable, a go.work or go.mod file containing a toolchain line—and downloads the toolchain from an untrusted GOMODPROXY or GOSUMDB. Specific version ranges are not specified in the available data.

The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog. The flaw permits an attacker to supply an altered Go toolchain that bypasses checksum validation and is then executed by the go command. This allows arbitrary code execution in the user’s environment whenever the toolchain is installed or a build triggers a download. The principal prerequisite is the use of an untrusted module proxy or checksum database; once such a source is used, the attacker can serve tampered modules that will be treated as valid. Consequently, the risk is significant for users relying on external proxies or whose checksum verification is misconfigured.