CVE-2025-4674
Unexpected command execution in untrusted VCS repositories in cmd/go
Vexday Risk Score
21Bajo
Decisión SSVC (CISA)
Track
Sin señal de explotación → monitorear
CVSS 8.6EPSS 0.3%KEV nãoPoC —Nuclei —Metasploit —Patch —
Ciclo de vida
29 jul 2025Publicada en NVD
Recomendación: Monitorear — sin señal de explotación por ahora.
The go command may execute unexpected commands when operating in untrusted VCS repositories. This occurs when possibly dangerous VCS configuration is present in repositories. This can happen when a repository was fetched via one VCS (e.g. Git), but contains metadata for another VCS (e.g. Mercurial). Modules which are retrieved using the go command line, i.e. via "go get", are not affected.
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
Productos afectados
Go toolchain · cmd/go¿Quieres saber si tu infraestructura está expuesta a esto?
Hablar con TrueHacking →