A malicious module proxy that implements the Go module proxy protocol can forge up to two sumdb tiles, allowing an attacker to bypass the GOSUMDB integrity check and write tampered module contents into a user’s local Go module cache. Because the tiles are not correctly verified against their parents, the trust chain for the transparency log is broken, enabling the injection of malicious module code that the Go toolchain will accept as legitimate. The attacker can then deliver arbitrary code that will be executed whenever a Go program pulls the poisoned module, leading to local code execution and compromising the confidentiality, integrity, and availability of downstream systems.

The vulnerability exists in the Go toolchain’s cmd/go command and in the golang.org/x/mod/sumdb/tlog package, affecting all releases prior to the patch that added correct parent‑tile verification; any Go installation that pulls modules via a proxy before the fix could be vulnerable.

Because the attack requires only a malicious or untrusted GOPROXY, the risk is elevated for any environment that does not enforce a trusted upstream; the vulnerability can lead to arbitrary code execution at the user level and can be used to compromise other systems that import the poisoned module. The EPSS score is less than 1%, indicating a very low probability of exploitation, yet the high severity (CVSS 8.4) and potential for remote code execution make it a high‑risk vulnerability. The vulnerability is not listed in the CISA KEV catalog, but the potential impact and ease of exploitation warrant immediate attention.