CVE-2025-4674 Details
Description
The go command may execute unexpected commands when operating in untrusted VCS repositories. This occurs when possibly dangerous VCS configuration is present in repositories. This can happen when a repository was fetched via one VCS (e.g. Git), but contains metadata for another VCS (e.g. Mercurial). Modules which are retrieved using the go command line, i.e. via "go get", are not affected.
A vulnerability exists in the Go command-line toolchain when used in untrusted version control system (VCS) repositories. This issue arises from the presence of potentially harmful VCS configuration metadata, which can lead to unexpected command execution. The vulnerability occurs when a repository, fetched through one VCS (like Git), contains metadata from another VCS (such as Mercurial). As a result, the Go toolchain may execute unintended commands while resolving VCS information for embedding build details in binaries and managing module versions. Notably, this vulnerability does not affect modules retrieved via 'go get'.
The Go toolchain has been updated to disable support for multiple VCS configurations in a single module, preventing this vulnerability. Users can manually apply this fix by updating to Go versions 1.24.5 or 1.23.11.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Aug 6, 2025References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| http://www.openwall.com/lists/oss-security/2025/07/08/5 | CVE | Mailing ListRelease Notes |
| https://go.dev/cl/686515 | [email protected] | Patch |
| https://go.dev/issue/74380 | [email protected] | Issue TrackingThird Party Advisory |
| https://groups.google.com/g/golang-announce/c/gTNJnDXmn34 | [email protected] | Mailing ListRelease Notes |
| https://pkg.go.dev/vuln/GO-2025-3828 | [email protected] | Vendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-73 | External Control of File Name or Path | CISA-ADP |
Affected Products
| Product | Versions |
|---|---|
| golang go | < 1.23.11 >= 1.24.0, < 1.24.5 |
CPE
Remediation
| |
Change History
6 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Jan 29, 2026 | Initial Analysis | [email protected] |
| Nov 4, 2025 | CVE Modified | CVE |
| Aug 6, 2025 | CVE Modified | CISA-ADP |
| Jul 29, 2025 | New CVE Received | [email protected] |