This vulnerability lets an attacker provide a malicious Go project that includes a forged golang.org/toolchain entry in go.sum and directs the Go toolchain to use a malicious GOMODPROXY. The toolchain, which normally retrieves the canonical checksum from the network, will instead accept the bogus checksum, enabling the attacker to inject and execute arbitrary code during dependency resolution. The weakness directly undermines integrity verification, effectively creating a supply‑chain break whereby an attacker can supply and run untrusted code.

All users of the Go toolchain’s command‑line tool cmd/go are potentially impacted, regardless of the specific installed version, if they fetch modules through GOMODPROXY. The vulnerability applies to any build that pulls golang.org/toolchain via a proxy or uses a custom proxy setting.

The exploit requires the victim to run a Go project that references the fake golang.org/toolchain checksum and use a malicious module proxy. The EPSS score is <1% (approx. 0.00126), indicating a very low but nonzero exploitation probability, and the vulnerability is not listed in the CISA KEV catalog. The CVSS score of 6.7 denotes moderate severity. Given the supply‑chain nature of the attack, the risk is significant for environments that trust external module proxies to supply code.