CVE-2025-4674: fallo de gravedad alta en Go toolchain cmd/go
Unexpected command execution in untrusted VCS repositories in cmd/go
Publicada el · Actualizada el
Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.
21Vexday Risk Score
Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.
ssvc Trackcvss 8.6epss 0.5%
The go command may execute unexpected commands when operating in untrusted VCS repositories. This occurs when possibly dangerous VCS configuration is present in repositories. This can happen when a repository was fetched via one VCS (e.g. Git), but contains metadata for another VCS (e.g. Mercurial). Modules which are retrieved using the go command line, i.e. via "go get", are not affected.
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
Productos afectados
Go toolchain · cmd/goCVEs relacionadas — Go toolchain cmd/go
En el mismo producto, de las más peligrosas a las menos.
CVE-2020-28367—Arbitrary code execution via the go command with cgo in cmd/goEPSS 2.4%CVE-2020-28366—Arbitrary code execution in go command with cgo in cmd/go and cmd/cgoEPSS 2.3%CVE-2023-39323HIGHArbitrary code execution during build via line directives in cmd/goEPSS 1.9%CVE-2023-29404CRITICALImproper handling of non-optional LDFLAGS in go command with cgo in cmd/goEPSS 1.8%CVE-2023-39320—Arbitrary code execution via go.mod toolchain directive in cmd/goEPSS 1.8%CVE-2023-29405CRITICALImproper sanitization of LDFLAGS with embedded spaces in go command with cgo in cmd/goEPSS 1.7%