CVE-2018-6574

CVE-2018-6574 describes a remote command execution vulnerability in Go versions before 1.8.7, 1.9.x before 1.9.4, and 1.10 pre-releases before 1.10rc2, impacting products like Debian, Golang, and Red Hat. This flaw allows an attacker to execute arbitrary commands during the "go get" source code build process by exploiting the gcc or clang plugin feature, as the -fplugin= and -plugin= arguments were not properly blocked. With a CVSS score of 7.8 (High), the vulnerability has a low attack complexity and requires local privileges, but can lead to high impact on confidentiality, integrity, and availability. While there is no evidence of active exploitation (not in KEV or Hot List) and no public exploit code (Metasploit, Nuclei, ExploitDB), it has garnered some community discussion and media coverage, indicating awareness.