Vulnerability · Published Jul 29, 2025 · Assigned by Go
CVE-2025-4674Unexpected command execution in untrusted VCS repositories in cmd/go
High 8.6
In plain English
A high-severity security flaw in cmd/go from Go toolchain. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 41% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
The go command may execute unexpected commands when operating in untrusted VCS repositories. This occurs when possibly dangerous VCS configuration is present in repositories. This can happen when a repository was fetched via one VCS (e.g. Git), but contains metadata for another VCS (e.g. Mercurial). Modules which are retrieved using the go command line, i.e. via "go get", are not affected.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| AlmaLinux:8 | delve | 1.24.1-1.module_el8.10.0+3977+66935a26 | ALSA-2025:13940 |
| AlmaLinux:8 | go-toolset | 1.24.6-1.module_el8.10.0+4033+4bf8b620 | ALSA-2025:13940 |
| AlmaLinux:9 | go-toolset | 1.24.6-1.el9_6 | ALSA-2025:13935 |
| AlmaLinux:8 | golang | 1.24.6-1.module_el8.10.0+4033+4bf8b620 | ALSA-2025:13940 |
| AlmaLinux:9 | golang | 1.24.6-1.el9_6 | ALSA-2025:13935 |
| AlmaLinux:8 | golang-bin | 1.24.6-1.module_el8.10.0+4033+4bf8b620 | ALSA-2025:13940 |
| AlmaLinux:9 | golang-bin | 1.24.6-1.el9_6 | ALSA-2025:13935 |
| AlmaLinux:10 | golang-docs | 1.24.6-1.el10_0.alma.1 | ALSA-2025:13941 |
| AlmaLinux:8 | golang-docs | 1.24.6-1.module_el8.10.0+4033+4bf8b620 | ALSA-2025:13940 |
| AlmaLinux:9 | golang-docs | 1.24.6-1.el9_6 | ALSA-2025:13935 |
| AlmaLinux:10 | golang-misc | 1.24.6-1.el10_0.alma.1 | ALSA-2025:13941 |
| AlmaLinux:8 | golang-misc | 1.24.6-1.module_el8.10.0+4033+4bf8b620 | ALSA-2025:13940 |
| AlmaLinux:9 | golang-misc | 1.24.6-1.el9_6 | ALSA-2025:13935 |
| AlmaLinux:9 | golang-race | 1.24.6-1.el9_6 | ALSA-2025:13935 |
| AlmaLinux:10 | golang-src | 1.24.6-1.el10_0.alma.1 | ALSA-2025:13941 |
| AlmaLinux:8 | golang-src | 1.24.6-1.module_el8.10.0+4033+4bf8b620 | ALSA-2025:13940 |
| AlmaLinux:9 | golang-src | 1.24.6-1.el9_6 | ALSA-2025:13935 |
| AlmaLinux:10 | golang-tests | 1.24.6-1.el10_0.alma.1 | ALSA-2025:13941 |
| AlmaLinux:8 | golang-tests | 1.24.6-1.module_el8.10.0+4033+4bf8b620 | ALSA-2025:13940 |
| AlmaLinux:9 | golang-tests | 1.24.6-1.el9_6 | ALSA-2025:13935 |
| Alpine:v3.22 | go | 1.24.6-r0 | ALPINE-CVE-2025-4674 |
| Alpine:v3.23 | go | 1.24.5-r0 | ALPINE-CVE-2025-4674 |
| Alpine:v3.24 | go | 1.24.5-r0 | ALPINE-CVE-2025-4674 |
| Debian:12 | golang-1.19 | no fix listed | DEBIAN-CVE-2025-4674 |
| Debian:13 | golang-1.24 | no fix listed | DEBIAN-CVE-2025-4674 |
| Go | toolchain | 1.23.11, 1.24.5 | GO-2025-3828 |
| Rocky Linux:8 | delve | 0:1.24.1-1.module+el8.10.0+1951+c74bd827 | RLSA-2025:13940 |
| Rocky Linux:8 | delve | 0:1.24.1-1.module+el8.10.0+1987+42f155bb | RLSA-2025:13940 |
| Rocky Linux:8 | go-toolset | 0:1.24.6-1.module+el8.10.0+2048+bc5b2e29 | RLSA-2025:13940 |
| Rocky Linux:10 | golang | 0:1.24.6-1.el10_0 | RLSA-2025:13941 |
| Rocky Linux:8 | golang | 0:1.24.6-1.module+el8.10.0+2048+bc5b2e29 | RLSA-2025:13940 |
| Rocky Linux:9 | golang | 0:1.24.6-1.el9_6 | RLSA-2025:13935 |
| Ubuntu:22.04:LTS | golang-1.18 | no fix listed | UBUNTU-CVE-2025-4674 |
| Ubuntu:22.04:LTS | golang-1.20 | no fix listed | UBUNTU-CVE-2025-4674 |
| Ubuntu:22.04:LTS | golang-1.21 | no fix listed | UBUNTU-CVE-2025-4674 |
| Ubuntu:24.04:LTS | golang-1.21 | no fix listed | UBUNTU-CVE-2025-4674 |
| Ubuntu:22.04:LTS | golang-1.22 | no fix listed | UBUNTU-CVE-2025-4674 |
| Ubuntu:24.04:LTS | golang-1.22 | no fix listed | UBUNTU-CVE-2025-4674 |
| Ubuntu:22.04:LTS | golang-1.23 | no fix listed | UBUNTU-CVE-2025-4674 |
| Ubuntu:24.04:LTS | golang-1.23 | no fix listed | UBUNTU-CVE-2025-4674 |
| Ubuntu:25.10 | golang-1.23 | no fix listed | UBUNTU-CVE-2025-4674 |
| Ubuntu:26.04:LTS | golang-1.23 | no fix listed | UBUNTU-CVE-2025-4674 |
| Ubuntu:25.10 | golang-1.24 | no fix listed | UBUNTU-CVE-2025-4674 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Go toolchain | cmd/go | 0 – before 1.23.111.24.0-0 – before 1.24.5 |
Weakness: CWE-73 · Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H