CVE-2025-61731: Arbitrary file write using cgo pkg-config directive in cmd/go
Building a malicious file with cmd/go can cause can cause a write to an attacker-controlled file with partial control of the file content. The "#cgo pkg-config:" directive in a Go source file provides command-line arguments to provide to the Go pkg-config command. An attacker can provide a "--log-file" argument to this directive, causing pkg-config to write to an attacker-controlled location.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-61731?
CVE-2025-61731 is categorized as a high-severity vulnerability due to its potential for arbitrary file write exploitation.
How do I fix CVE-2025-61731?
To mitigate CVE-2025-61731, ensure that you avoid the use of the "#cgo pkg-config:" directive with untrusted inputs in your Go applications.
What types of files can be affected by CVE-2025-61731?
CVE-2025-61731 can lead to arbitrary file writes, impacting any file that an attacker can control if proper precautions are not taken.
Which versions of Go are affected by CVE-2025-61731?
CVE-2025-61731 affects versions of Go prior to the fix being applied in the upcoming updates.
Is CVE-2025-61731 considered a serious risk for production environments?
Yes, CVE-2025-61731 poses a serious risk in production environments as it allows for unauthorized file creation and potential code execution.