High severity · published Jul 29, 2025
CVE-2025-4674
Unexpected command execution in untrusted VCS repositories in cmd/go
8.6
CVSS
0.4%
EPSS
No
On KEV
Description
The go command may execute unexpected commands when operating in untrusted VCS repositories. This occurs when possibly dangerous VCS configuration is present in repositories. This can happen when a repository was fetched via one VCS (e.g. Git), but contains metadata for another VCS (e.g. Mercurial). Modules which are retrieved using the go command line, i.e. via "go get", are not affected.
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
Attack vector
Local
Complexity
Low
Privileges
None
User interaction
Required
Confidentiality
High
Integrity
High
Availability
High
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 38% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
CM
cmd/go · Go toolchain
before 1.23.11; 1.24.0-0 before 1.24.5 · source: vendor
GO
GO · Golang
before 1.23.11; 1.24.0 before 1.24.5 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-4674
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-4674
Patch
https://go.dev/cl/686515
Issue Tracking
https://go.dev/issue/74380
Mailing List
https://groups.google.com/g/golang-announce/c/gTNJnDXmn34
Vendor Advisory
https://pkg.go.dev/vuln/GO-2025-3828
Mailing List
http://www.openwall.com/lists/oss-security/2025/07/08/5
More from cmd/go
9.8
CVE-2023-24531
Output of "go env" does not sanitize values in cmd/go
8.8
CVE-2026-27140
Code execution vulnerability in SWIG code generation in cmd/go
8.8
CVE-2024-45340
GOAUTH credential leak in cmd/go
8.4
CVE-2026-56865
Fix transparency log tile verification bypass in golang.org/x/mod/sumdb/tlog
7.8
CVE-2026-94447
Checksum database bypass for golang.org/toolchain in cmd/go