Vulnerability · Published Jan 28, 2026 · Assigned by Go
CVE-2025-61731Arbitrary file write using cgo pkg-config directive in cmd/go
High 7.8
In plain English
A high-severity argument injection in cmd/go from Go toolchain. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.6% (higher than 49% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Severity (CVSS 3.1)7.8High
Exploit odds (30 days)0.6%top 50.6% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
Building a malicious file with cmd/go can cause can cause a write to an attacker-controlled file with partial control of the file content. The "#cgo pkg-config:" directive in a Go source file provides command-line arguments to provide to the Go pkg-config command. An attacker can provide a "--log-file" argument to this directive, causing pkg-config to write to an attacker-controlled location.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| AlmaLinux:8 | delve | 1.25.2-1.module_el8.10.0+4074+24330916 | ALSA-2026:6949 |
| AlmaLinux:8 | go-toolset | 1.25.8-1.module_el8.10.0+4156+92f0ae2f | ALSA-2026:6949 |
| AlmaLinux:9 | go-toolset | 1.25.8-1.el9_7 | ALSA-2026:5942 |
| AlmaLinux:8 | golang | 1.25.8-1.module_el8.10.0+4156+92f0ae2f | ALSA-2026:6949 |
| AlmaLinux:9 | golang | 1.25.8-1.el9_7 | ALSA-2026:5942 |
| AlmaLinux:8 | golang-bin | 1.25.8-1.module_el8.10.0+4156+92f0ae2f | ALSA-2026:6949 |
| AlmaLinux:9 | golang-bin | 1.25.8-1.el9_7 | ALSA-2026:5942 |
| AlmaLinux:10 | golang-docs | 1.25.8-1.el10_1.alma.1 | ALSA-2026:5941 |
| AlmaLinux:8 | golang-docs | 1.25.8-1.module_el8.10.0+4156+92f0ae2f | ALSA-2026:6949 |
| AlmaLinux:9 | golang-docs | 1.25.8-1.el9_7 | ALSA-2026:5942 |
| AlmaLinux:10 | golang-misc | 1.25.8-1.el10_1.alma.1 | ALSA-2026:5941 |
| AlmaLinux:8 | golang-misc | 1.25.8-1.module_el8.10.0+4156+92f0ae2f | ALSA-2026:6949 |
| AlmaLinux:9 | golang-misc | 1.25.8-1.el9_7 | ALSA-2026:5942 |
| AlmaLinux:8 | golang-race | 1.25.8-1.module_el8.10.0+4156+92f0ae2f | ALSA-2026:6949 |
| AlmaLinux:9 | golang-race | 1.25.8-1.el9_7 | ALSA-2026:5942 |
| AlmaLinux:10 | golang-src | 1.25.8-1.el10_1.alma.1 | ALSA-2026:5941 |
| AlmaLinux:8 | golang-src | 1.25.8-1.module_el8.10.0+4156+92f0ae2f | ALSA-2026:6949 |
| AlmaLinux:9 | golang-src | 1.25.8-1.el9_7 | ALSA-2026:5942 |
| AlmaLinux:10 | golang-tests | 1.25.8-1.el10_1.alma.1 | ALSA-2026:5941 |
| AlmaLinux:8 | golang-tests | 1.25.8-1.module_el8.10.0+4156+92f0ae2f | ALSA-2026:6949 |
| AlmaLinux:9 | golang-tests | 1.25.8-1.el9_7 | ALSA-2026:5942 |
| Alpine:v3.23 | etcd | 3.6.8-r0 | ALPINE-CVE-2025-61731 |
| Alpine:v3.24 | etcd | 3.6.8-r0 | ALPINE-CVE-2025-61731 |
| Alpine:v3.22 | go | 1.24.12-r0 | ALPINE-CVE-2025-61731 |
| Alpine:v3.23 | go | 1.25.6-r0 | ALPINE-CVE-2025-61731 |
| Alpine:v3.24 | go | 1.25.6-r0 | ALPINE-CVE-2025-61731 |
| Debian:12 | golang-1.19 | no fix listed | DEBIAN-CVE-2025-61731 |
| Debian:13 | golang-1.24 | no fix listed | DEBIAN-CVE-2025-61731 |
| Go | toolchain | 1.24.12, 1.25.6 | GO-2026-4339 |
| Rocky Linux:8 | delve | 0:1.25.2-1.module+el8.10.0+40035+ee0a7047 | RLSA-2026:6949 |
| Rocky Linux:10 | golang | 0:1.25.8-1.el10_1 | RLSA-2026:5941 |
| Rocky Linux:9 | golang | 0:1.25.8-1.el9_7 | RLSA-2026:5942 |
| Ubuntu:22.04:LTS | golang-1.17 | no fix listed | UBUNTU-CVE-2025-61731 |
| Ubuntu:22.04:LTS | golang-1.18 | no fix listed | UBUNTU-CVE-2025-61731 |
| Ubuntu:22.04:LTS | golang-1.20 | no fix listed | UBUNTU-CVE-2025-61731 |
| Ubuntu:22.04:LTS | golang-1.21 | no fix listed | UBUNTU-CVE-2025-61731 |
| Ubuntu:24.04:LTS | golang-1.21 | no fix listed | UBUNTU-CVE-2025-61731 |
| Ubuntu:22.04:LTS | golang-1.22 | no fix listed | UBUNTU-CVE-2025-61731 |
| Ubuntu:24.04:LTS | golang-1.22 | no fix listed | UBUNTU-CVE-2025-61731 |
| Ubuntu:22.04:LTS | golang-1.23 | no fix listed | UBUNTU-CVE-2025-61731 |
| Ubuntu:24.04:LTS | golang-1.23 | no fix listed | UBUNTU-CVE-2025-61731 |
| Ubuntu:25.10 | golang-1.23 | no fix listed | UBUNTU-CVE-2025-61731 |
| Ubuntu:26.04:LTS | golang-1.23 | no fix listed | UBUNTU-CVE-2025-61731 |
| Ubuntu:22.04:LTS | golang-1.24 | no fix listed | UBUNTU-CVE-2025-61731 |
| Ubuntu:24.04:LTS | golang-1.24 | no fix listed | UBUNTU-CVE-2025-61731 |
| Ubuntu:25.10 | golang-1.24 | no fix listed | UBUNTU-CVE-2025-61731 |
| Ubuntu:26.04:LTS | golang-1.24 | no fix listed | UBUNTU-CVE-2025-61731 |
| Ubuntu:22.04:LTS | golang-1.25 | no fix listed | UBUNTU-CVE-2025-61731 |
| Ubuntu:24.04:LTS | golang-1.25 | no fix listed | UBUNTU-CVE-2025-61731 |
| Ubuntu:25.10 | golang-1.25 | no fix listed | UBUNTU-CVE-2025-61731 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Go toolchain | cmd/go | 0 – before 1.24.121.25.0 – before 1.25.6 |
Weakness: CWE-88 · Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
References
- https://go.dev/cl/736711
- https://go.dev/issue/77100
- https://groups.google.com/g/golang-announce/c/Vd2tYVM8eUc
- https://pkg.go.dev/vuln/GO-2026-4339
- https://access.redhat.com/security/cve/CVE-2025-61731 vdb-entry, x_refsource_REDHAT
- RHBZ#2434433 issue-tracking, x_refsource_REDHAT
- https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-61731.json x_sadp-csaf-vex
- https://access.redhat.com/errata/RHSA-2026:5943 vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:5941 vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:6949 vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:7878 vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:7879 vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:7876 vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:7877 vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:7883 vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:7833 vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:7834 vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:5944 vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:5942 vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:7385 vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:7291 vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:12282 vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:14100 vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:21691 vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:15091 vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:14774 vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:20088 vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:17598 vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:12118 vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:8448 vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:13736 vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:4434 vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:3855 vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:3559 vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:3556 vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:5948 vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:5950 vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:5952 vendor-advisory, x_refsource_REDHAT