CVE-2021-3115: fedoraproject fedora Uncontrolled Search Path Element
Vulnerability summary
CVE-2021-3115 is a high (CVSS 7.5) Uncontrolled Search Path Element vulnerability in fedoraproject fedora. EPSS estimates a 6.91% chance of exploitation in the next 30 days, higher than 94% of scored vulnerabilities.
Not severe (CVSS 7.5, network access); no exploitation reported by the 5 checked sources
Source freshness unavailable
How is this decided?Advisory lineage
Upstream 0 · Downstream 10 · Related 7Timeline
- 26-01-2021PublishedVulnerability first disclosed.
- 03-08-2024Last modifiedVulnerability information updated.
Description
Go before 1.14.14 and 1.15.x before 1.15.7 on Windows is vulnerable to Command Injection and remote code execution when using the "go get" command to fetch modules that make use of cgo (for example, cgo can execute a gcc program from an untrusted download).
CVSS metrics
4 scores · 3 sources · 2 versions- OSV · DebianEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
- OSV · AlpineEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
EPSS trend
Probability
6.91%
Chance of exploitation in the next 30 days
Percentile
94%
Versus all other CVEs
30-day change
Increase +0.28 pp
From 6.62% on 04-10-2026
Known exploited
Compare KEV catalogs
CISA KEVNot in the CISA KEV catalog.
ENISA CNWNot in the ENISA CNW catalog.
CIRCLNot in the CIRCL catalog.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Known conditions: network-reachable, no authentication, user interaction (CVSS vector). Other conditions: not stated in public data.
Netapp2 products
Alpine1 product
- go≥ 1.15, < 1.15.7-r0
Debian1 product
- golang-1.15< 1.15.7-1
Fedoraproject1 product
- fedoraEOL33
Go1 product
- toolchain≥ 1.15.0-0, < 1.15.7
Golang1 product
- go< 1.14.14 | ≥ 1.15, < 1.15.7
6 vendors · 7 products
References
14 links- groups.google.com/g/golang-announce/c/mperVMGa98wX Refsource CONFIRMRelease NotesThird Party Advisory
- go.dev/issue/43783REPORT
