| id: GO-2026-4338 |
| modules: |
| - module: cmd |
| versions: |
| - introduced: 1.25.0 |
| - fixed: 1.25.6 |
| vulnerable_at: 1.25.5 |
| packages: |
| - package: cmd/go |
| summary: Unexpected code execution when invoking toolchain in cmd/go |
| description: |- |
| Downloading and building modules with malicious version strings |
| can cause local code execution. |
| |
| On systems with Mercurial (hg) installed, downloading modules |
| from non-standard sources (e.g., custom domains) can cause |
| unexpected code execution due to how external VCS commands |
| are constructed. This issue can also be triggered by |
| providing a malicious version string to the toolchain. |
| |
| On systems with Git installed, downloading and building |
| modules with malicious version strings can allow an attacker |
| to write to arbitrary files on the filesystem. |
| This can only be triggered by explicitly providing the |
| malicious version strings to the toolchain and does not |
| affect usage of @latest or bare module paths. |
| cves: |
| - CVE-2025-68119 |
| credits: |
| - splitline (@splitline) from DEVCORE Research Team |
| references: |
| - fix: https://go.dev/cl/736710 |
| - report: https://go.dev/issue/77099 |
| - web: https://groups.google.com/g/golang-announce/c/Vd2tYVM8eUc |
| cve_metadata: |
| id: CVE-2025-68119 |
| cwe: 'CWE-78: Improper Neutralization of Special Elements used in an OS Command (''OS Command Injection'')' |
| source: |
| id: go-security-team |
| created: 2026-01-20T15:57:16.198332-08:00 |
| review_status: REVIEWED |
