CVE-2023-24531

What it actually does

The go env command outputs environment variable values without sanitization, allowing shell metacharacters or new variable assignments in the printed output that are executed when the output is sourced as a script.

Why it matters to the business

Organizations relying on Go tooling in build pipelines, scripts, or CI systems face a risk of unintended command execution or environment manipulation if go env output is ever treated as trusted shell input, though the practical impact is limited because attackers who can already control environment variables usually have stronger options.

How an attack unfolds

An attacker who can influence environment variables on a system sets values containing shell commands or new variable definitions; a subsequent invocation of go env whose output is piped or sourced into a shell then executes the attacker-controlled content.

How to fix it

Avoid sourcing or executing the raw output of go env in any shell context; prefer go env -json for machine-readable output and parse it safely with language-native tools instead of shell evaluation.

How to confirm the fix worked

Confirm that no build or deployment scripts invoke go env and then source or eval its stdout; test by setting an environment variable containing a harmless command and verifying it does not execute when go env output is used.

Typical attack path

1. Attacker obtains ability to set arbitrary environment variables on a target system
2. Attacker ensures go env will be executed and its output sourced or evaluated by a shell script or build step
3. go env prints the malicious variable values without escaping
4. Shell sourcing of the output executes the injected commands or defines attacker variables

How to detect it

Review build logs, CI job output, and shell history for invocations of go env whose output is subsequently sourced, evaled, or piped to sh/bash; look for environment variables containing shell metacharacters or unexpected command strings around the time of such invocations.

What your security team should do

• Audit all scripts and CI pipelines that invoke go env and replace any sourcing or eval usage
• Add static analysis or lint rules to flag direct shell sourcing of go env output
• Educate developers on using go env -json and safe parsing instead of shell evaluation