CVE-2025-61731 Details
Description
Building a malicious file with cmd/go can cause can cause a write to an attacker-controlled file with partial control of the file content. The "#cgo pkg-config:" directive in a Go source file provides command-line arguments to provide to the Go pkg-config command. An attacker can provide a "--log-file" argument to this directive, causing pkg-config to write to an attacker-controlled location.
A vulnerability in the Go command line tool (cmd/go) allows for arbitrary file writes, with partial control over the file content. This issue arises from the '#cgo pkg-config:' directive in Go source files, which can be manipulated to include unsafe command-line arguments. By providing a '--log-file' option, an attacker can direct pkg-config to write to a location of their choosing.
This vulnerability has been addressed in Go versions 1.24.12 and 1.25.6. Users can download the latest version from the Go website or compile it from source.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Jan 29, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| NVD-CWE-noinfo | Insufficient Information to Classify Weakness | [email protected] |
| CWE-88 | Improper Neutralization of Argument Delimiters in a Command ('Argument Injection') | redhat-SADP |
Affected Products
| Product | Versions |
|---|---|
| golang go | < 1.24.12 >= 1.25.0, < 1.25.6 |
CPE
Remediation
| |
Change History
22 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Sep 10, 2026 | CVE Modified | redhat-SADP |
| Sep 7, 2026 | CVE Modified | redhat-SADP |
| Aug 26, 2026 | CVE Modified | redhat-SADP |
| Aug 26, 2026 | CVE Modified | [email protected] |
| Aug 24, 2026 | CVE Modified | redhat-SADP |
| Aug 19, 2026 | CVE Modified | redhat-SADP |
| Aug 17, 2026 | CVE Modified | redhat-SADP |
| Aug 10, 2026 | CVE Modified | redhat-SADP |
| Aug 5, 2026 | CVE Modified | redhat-SADP |
| Aug 3, 2026 | CVE Modified | redhat-SADP |
| Jul 27, 2026 | CVE Modified | redhat-SADP |
| Jul 20, 2026 | CVE Modified | redhat-SADP |
| Jul 15, 2026 | CVE Modified | redhat-SADP |
| Jul 13, 2026 | CVE Modified | redhat-SADP |
| Jul 9, 2026 | CVE Modified | redhat-SADP |
| Jul 8, 2026 | CVE Modified | redhat-SADP |
| Jun 30, 2026 | CVE Modified | redhat-SADP |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Jun 17, 2026 | CVE Modified | [email protected] |
| Feb 6, 2026 | Initial Analysis | [email protected] |
| Jan 29, 2026 | CVE Modified | CISA-ADP |
| Jan 28, 2026 | New CVE Received | [email protected] |