BIT-golang-2025-4674

vendorUSosv

Unexpected command execution in untrusted VCS repositories in cmd/go

view advisory published 2025-07-31Licence: per source

The go command may execute unexpected commands when operating in untrusted VCS repositories. This occurs when possibly dangerous VCS configuration is present in repositories. This can happen when a repository was fetched via one VCS (e.g. Git), but contains metadata for another VCS (e.g. Mercurial). Modules which are retrieved using the go command line, i.e. via "go get", are not affected.

describes (1)

Related CVEs.

ID	severity	EPSS	exploitable	published
CVE-2025-4674US	—	0.44% (38th)	—	2025-07-29
The go command may execute unexpected commands when operating in untrusted VCS repositories. This occurs when possibly dangerous VCS configuration is present in repositories. This…

references

External citations — patches, advisories, analysis.

http://www.openwall.com/lists/oss-security/2025/07/08/5DISCUSSION
https://go.dev/cl/686515FIX
https://go.dev/issue/74380ADVISORY
https://groups.google.com/g/golang-announce/c/gTNJnDXmn34DISCUSSION
https://nvd.nist.gov/vuln/detail/CVE-2025-4674WEB
https://pkg.go.dev/vuln/GO-2025-3828ADVISORY

scry

Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.

Free scan