CVE-2025-4674: Unexpected command execution in untrusted VCS repositories in cmd/go
The go command may execute unexpected commands when operating in untrusted VCS repositories. This occurs when possibly dangerous VCS configuration is present in repositories. This can happen when a repository was fetched via one VCS (e.g. Git), but contains metadata for another VCS (e.g. Mercurial). Modules which are retrieved using the go command line, i.e. via "go get", are not affected.
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2025-4674?
CVE-2025-4674 has been classified as a moderate severity vulnerability due to its potential to execute unexpected commands.
How do I fix CVE-2025-4674?
To fix CVE-2025-4674, ensure that you only use trusted VCS repositories and avoid mixing metadata from different VCS systems.
What software is affected by CVE-2025-4674?
CVE-2025-4674 affects the Go programming language's command-line tools when used with untrusted version control systems.
What types of VCS configurations are involved in CVE-2025-4674?
CVE-2025-4674 involves potentially dangerous VCS configurations resulting from mixed repository metadata.
Can CVE-2025-4674 lead to remote code execution?
While CVE-2025-4674 can lead to unexpected command execution, it does not directly cause remote code execution without further exploitation.