CVE-2023-45285

score

<0.1

cvss

7.5

epss

1.1%

published

2023-12-06

kev added

—

first seen

2026-10-21

Using 'go get' to fetch a module with the '.git' suffix may fallback to the insecure 'git://' protocol if the module is unavailable via 'https://' and 'git+ssh://', letting attackers intercept or modify the fetch process, exploit requires direct module fetch without proxy.