Go before 1.8.7, Go 1.9.x before 1.9.4, and Go 1.10 pre-releases before Go 1.10rc2 allow "go get" remote command execution during source code build, by leveraging the gcc or clang plugin feature, because -fplugin= and -plugin= arguments were not blocked.
{ "binaries": [ { "binary_name": "golang-1.9", "binary_version": "1.9.4-1ubuntu1" }, { "binary_name": "golang-1.9-doc", "binary_version": "1.9.4-1ubuntu1" }, { "binary_name": "golang-1.9-go", "binary_version": "1.9.4-1ubuntu1" }, { "binary_name": "golang-1.9-go-dbgsym", "binary_version": "1.9.4-1ubuntu1" }, { "binary_name": "golang-1.9-src", "binary_version": "1.9.4-1ubuntu1" } ], "ubuntu_priority": "low", "availability": "No subscription required" }