CVE-2025-4674

Unexpected command execution in untrusted VCS repositories in cmd/go

High · published July 29, 2025

CVSS v3.1
8.6
EPSS
0%
Percentile
37.4
In the wild
Unconfirmed
What it is

The go command may execute unexpected commands when operating in untrusted VCS repositories. This occurs when possibly dangerous VCS configuration is present in repositories. This can happen when a repository was fetched via one VCS (e.g. Git), but contains metadata for another VCS (e.g. Mercurial). Modules which are retrieved using the go command line, i.e. via "go get", are not affected.

The record
Technical detail
CVSS v3.1
8.6 · HIGH
Vector
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00442 · 37.4th percentile
Published
2025-07-29T21:19Z
EPSS history
Timeline
  • 29 JUL 21:19Z
    Unexpected command execution in untrusted VCS repositories in cmd/go
    cvelistv5