A malicious module proxy can bypass the Go command’s checksum database validation by returning an empty or unrelated checksum entry. Because the go tool only relies on the checksum database when a module is not listed in go.sum, a missing entry is incorrectly accepted, allowing an attacker to supply an altered toolchain module. The resulting malicious toolchain can be executed during a build or version switch, giving the attacker arbitrary code execution in the user’s environment.

This vulnerability applies to the Go toolchain’s cmd/go component when the user selects a different Go toolchain version—through the GOTOOLCHAIN environment variable, a go.work or go.mod file containing a toolchain line—and downloads the toolchain from an untrusted GOMODPROXY or GOSUMDB. Specific version ranges are not specified in the available data.

The CVSS score of 7.5 indicates high severity. The EPSS score is <1%, reflecting a low but nonzero probability of exploitation, and the vulnerability is not listed in the CISA KEV catalog. The flaw permits an attacker to supply an altered Go toolchain by exploiting the incorrect validation when a checksum database returns an empty or unrelated entry. The modified toolchain is then executed by the go command during a toolchain switch or build, giving the attacker arbitrary code execution in the user’s environment. The prerequisite for exploitation is the use of an untrusted GOMODPROXY or GOSUMDB; once such a source is used, the attacker can serve tampered modules that will be treated as valid. Consequently, the risk is significant for users relying on external proxies or having misconfigured checksum verification.