CVE-2025-68119

Published Jan 28, 2026

Last updated a month ago

CVSS high 7.0

Golang

Overview

Description: Downloading and building modules with malicious version strings can cause local code execution. On systems with Mercurial (hg) installed, downloading modules from non-standard sources (e.g., custom domains) can cause unexpected code execution due to how external VCS commands are constructed. This issue can also be triggered by providing a malicious version string to the toolchain. On systems with Git installed, downloading and building modules with malicious version strings can allow an attacker to write to arbitrary files on the filesystem. This can only be triggered by explicitly providing the malicious version strings to the toolchain and does not affect usage of @latest or bare module paths.
Source: security@golang.org
NVD status: Analyzed
Products: go

Risk scores

CVSS 3.1

Type: Secondary
Base score: 7
Impact score: 5.9
Exploitability score: 1
Vector string: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Severity: HIGH

Weaknesses

nvd@nist.gov: CWE-787

Hype score: Not currently trending

Configurations

[
  {
    "nodes": [
      {
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:a:golang:go:*:*:*:*:*:*:*:*",
            "matchCriteriaId": "21FD9368-8AB3-404B-8599-BBF64EFE3C7B",
            "versionEndExcluding": "1.24.12",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:a:golang:go:*:*:*:*:*:*:*:*",
            "matchCriteriaId": "A547E844-78D2-4B17-B7A9-73E7B503D2CE",
            "versionEndExcluding": "1.25.6",
            "versionStartIncluding": "1.25.0",
            "vulnerable": true
          }
        ],
        "negate": false,
        "operator": "OR"
      }
    ]
  }
]

References

Sources include official advisories and independent security research.

Overview

Risk scores

CVSS 3.1

Weaknesses

Social media

Configurations

Related CVEs

References