High severity · published Jul 29, 2025
CVE-2025-4674
The go command may execute unexpected commands when operating in untrusted VCS repositories
8.6
CVSS
0.4%
EPSS
No
On KEV
Description
The go command may execute unexpected commands when operating in untrusted VCS repositories. This occurs when possibly dangerous VCS configuration is present in repositories. This can happen when a repository was fetched via one VCS (e.g. Git), but contains metadata for another VCS (e.g. Mercurial). Modules which are retrieved using the go command line, i.e. via "go get", are not affected.
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
Attack vector
Local
Complexity
Low
Privileges
None
User interaction
Required
Confidentiality
High
Integrity
High
Availability
High
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 38% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
GO
GO · Golang
before 1.23.11; 1.24.0 before 1.24.5 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-4674
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-4674
Patch
https://go.dev/cl/686515
Issue Tracking
https://go.dev/issue/74380
Mailing List
https://groups.google.com/g/golang-announce/c/gTNJnDXmn34
Vendor Advisory
https://pkg.go.dev/vuln/GO-2025-3828
Mailing List
http://www.openwall.com/lists/oss-security/2025/07/08/5
More from GO
8.1
CVE-2020-0601
Microsoft Windows CryptoAPI Spoofing Vulnerability
7.5
CVE-2023-44487
HTTP/2 Rapid Reset Attack Vulnerability
10.0
CVE-2025-68121
Unexpected session resumption in crypto/tls
9.8
CVE-2026-27143
Missing bound checks can lead to memory corruption in safe Go in cmd/compile
9.8
CVE-2024-24790
The various Is methods (IsPrivate, IsLoopback, etc) did not work as expected for IPv4-mapped IPv6 addresses, returning false for addresses which would return true in their…