CVE-2025-61731highCWE-88

CVE-2025-61731: falha de alta gravidade em Go toolchain cmd/go

Arbitrary file write using cgo pkg-config directive in cmd/go

Publicada em · Atualizada em

Seguir esta CVE+ Monitorar cmd/go+ Monitorar go

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

21Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 7.8epss 0.6%
Building a malicious file with cmd/go can cause can cause a write to an attacker-controlled file with partial control of the file content. The "#cgo pkg-config:" directive in a Go source file provides command-line arguments to provide to the Go pkg-config command. An attacker can provide a "--log-file" argument to this directive, causing pkg-config to write to an attacker-controlled location.
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Produtos afetados
Go toolchain · cmd/go
CVEs relacionadas — Go toolchain cmd/go

No mesmo produto, das mais perigosas para as menos.

CVE-2020-28367—Arbitrary code execution via the go command with cgo in cmd/goEPSS 2.4%CVE-2020-28366—Arbitrary code execution in go command with cgo in cmd/go and cmd/cgoEPSS 2.3%CVE-2023-39323HIGHArbitrary code execution during build via line directives in cmd/goEPSS 1.9%CVE-2023-29404CRITICALImproper handling of non-optional LDFLAGS in go command with cgo in cmd/goEPSS 1.8%CVE-2023-39320—Arbitrary code execution via go.mod toolchain directive in cmd/goEPSS 1.8%CVE-2023-29405CRITICALImproper sanitization of LDFLAGS with embedded spaces in go command with cgo in cmd/goEPSS 1.7%