fkie_cve-2025-4674
Vulnerability from fkie_nvd
Published
2025-07-29 22:15
Modified
2025-08-06 16:15
Severity ?
8.6 (High) - CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
Summary
The go command may execute unexpected commands when operating in untrusted VCS repositories. This occurs when possibly dangerous VCS configuration is present in repositories. This can happen when a repository was fetched via one VCS (e.g. Git), but contains metadata for another VCS (e.g. Mercurial). Modules which are retrieved using the go command line, i.e. via "go get", are not affected.
References
security@golang.orghttps://go.dev/cl/686515
security@golang.orghttps://go.dev/issue/74380
security@golang.orghttps://groups.google.com/g/golang-announce/c/gTNJnDXmn34
security@golang.orghttps://pkg.go.dev/vuln/GO-2025-3828
Impacted products
Vendor Product Version


To clipboard 

{
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "The go command may execute unexpected commands when operating in untrusted VCS repositories. This occurs when possibly dangerous VCS configuration is present in repositories. This can happen when a repository was fetched via one VCS (e.g. Git), but contains metadata for another VCS (e.g. Mercurial). Modules which are retrieved using the go command line, i.e. via \"go get\", are not affected."
    },
    {
      "lang": "es",
      "value": "El comando \"go\" puede ejecutar comandos inesperados al operar en repositorios VCS no confiables. Esto ocurre cuando existe una configuraci\u00f3n de VCS potencialmente peligrosa en los repositorios. Esto puede ocurrir cuando un repositorio se obtuvo mediante un VCS (p. ej., Git), pero contiene metadatos para otro VCS (p. ej., Mercurial). Los m\u00f3dulos obtenidos mediante la l\u00ednea de comandos \"go get\" no se ven afectados."
    }
  ],
  "id": "CVE-2025-4674",
  "lastModified": "2025-08-06T16:15:30.087",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "LOCAL",
          "availabilityImpact": "HIGH",
          "baseScore": 8.6,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "scope": "CHANGED",
          "userInteraction": "REQUIRED",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 1.8,
        "impactScore": 6.0,
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "type": "Secondary"
      }
    ]
  },
  "published": "2025-07-29T22:15:25.380",
  "references": [
    {
      "source": "security@golang.org",
      "url": "https://go.dev/cl/686515"
    },
    {
      "source": "security@golang.org",
      "url": "https://go.dev/issue/74380"
    },
    {
      "source": "security@golang.org",
      "url": "https://groups.google.com/g/golang-announce/c/gTNJnDXmn34"
    },
    {
      "source": "security@golang.org",
      "url": "https://pkg.go.dev/vuln/GO-2025-3828"
    }
  ],
  "sourceIdentifier": "security@golang.org",
  "vulnStatus": "Awaiting Analysis",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-73"
        }
      ],
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "type": "Secondary"
    }
  ]
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.