PT-2025-28646 · Go+8 · Go+8
Ryotak
·
Published
2025-01-01
·
Updated
2026-03-11
·
CVE-2025-4674
CVSS v3.1
8.6
High
| Vector | AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions:
Go versions prior to 1.24.5
Go versions prior to 1.23.11
Description:
The issue concerns unexpected command execution in untrusted VCS repositories when using the Go toolchain. This can occur when the toolchain is used in directories fetched using VCS tools, such as cloning Git or Mercurial repositories.
Recommendations:
For versions prior to 1.24.5, update to version 1.24.5 to resolve the issue.
For versions prior to 1.23.11, update to version 1.23.11 to resolve the issue.
As a temporary workaround, consider avoiding the use of the Go toolchain in untrusted VCS repositories until a patch is applied.
Fix
RCE
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Alt Linux
Almalinux
Centos
Debian
Go
Red Hat
Red Os
Rocky Linux
Suse