CVE-2021-3115

CVE-2021-3115 is a command injection and remote code execution vulnerability affecting Go versions before 1.14.14 and 1.15.x before 1.15.7 on Windows. It occurs when the "go get" command fetches modules utilizing cgo, potentially allowing untrusted code execution via gcc. This vulnerability carries a CVSS score of 7.5 (HIGH), indicating a network-based attack with high complexity, requiring user interaction, but leading to high confidentiality, integrity, and availability impacts. There is no evidence of active exploitation, public exploit code (Metasploit, Nuclei, ExploitDB), or inclusion in CISA's KEV catalog, though it has received some community discussion and media coverage.