8.6Yüksek

CVE-2025-4674Unexpected command execution in untrusted VCS repositories in cmd/go

Go toolchain cmd/go Yayım: 2025-07-30 00:19 (1 yıl önce)

Açıklama

The go command may execute unexpected commands when operating in untrusted VCS repositories. This occurs when possibly dangerous VCS configuration is present in repositories. This can happen when a repository was fetched via one VCS (e.g. Git), but contains metadata for another VCS (e.g. Mercurial). Modules which are retrieved using the go command line, i.e. via "go get", are not affected.

Zayıflık türü (CWE): CWE-73

Veri: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Bilgiler kaynaktaki haliyle, İngilizce yayımlanır.

Etkilenen ürünler ve sürümler

Üretici	Ürün	Sürümler
Go toolchain	cmd/go	< 1.23.11, 1.24.0-0 – < 1.24.5
golang	go	< 1.23.11

Kaynaklar ve yamalar

https://go.dev/cl/686515 Patch
https://go.dev/issue/74380 Issue TrackingThird Party Advisory
https://groups.google.com/g/golang-announce/c/gTNJnDXmn34 Mailing ListRelease Notes
https://pkg.go.dev/vuln/GO-2025-3828 Vendor Advisory
http://www.openwall.com/lists/oss-security/2025/07/08/5 Mailing ListRelease Notes

CPE eşleşmeleri (NVD) (2)

cpe:2.3:a:golang:go:*:*:*:*:*:*:*:* < 1.23.11
cpe:2.3:a:golang:go:*:*:*:*:*:*:*:* ≥ 1.24.0 < 1.24.5

CVSS puanı

8.6Yüksek

Kaynak: CISA-ADP · CVSS 3.1

Saldırı yolu: Yerel
Karmaşıklık: Düşük
Gereken yetki: Yok
Kullanıcı etkileşimi: Gerekir
Kapsam: Değişir
Gizlilik: Yüksek
Bütünlük: Yüksek
Erişilebilirlik: Yüksek

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

Tüm puanlar (2)

CISA-ADP	CVSS 3.1	8.6Yüksek
134c704f-9b21-4f2e-91b3-4a467353bcc0	CVSS 3.1	8.6Yüksek

EPSS (30 günde istismar olasılığı)

0.47%

tüm CVE'lerin %41'inden yüksek

CISA değerlendirmesi (SSVC)

İstismar: none
Otomatikleştirilebilir: no
Teknik etki: total

Zaman çizelgesi

Numara ayrıldı2025-05-13
Yayımlandı2025-07-30 00:19
IP-DB'ye ulaştı2026-10-25 00:03
Son güncelleme2026-06-17 12:33

Numarayı veren (CNA): Go
NVD durumu: Analyzed

Kaynakta görüntüle: CVE.org · NVD

Bu ürünlerde yeni bir açık çıktığında haber alın

E-posta uyarılarını aç

Ücretsiz · üyelikle · istediğiniz an kapatılır

Aynı üründe son açıklar — Go

Puansız

CVE-2026-97033 12 saat önce

Unexpected code execution via --sysroot, -target, -isysroot, -Wl,-syslibroot, and -x cgo flags in cmd/go

Go toolchain cmd/go

Building a malicious package that uses cgo could cause arbitrary code execution at build time through several compiler and linker flags permitted in "#cgo" directives. Specifically, "--sysroot" in GCC and Clang relocates compiler subprograms, spec files, and …

Puansız

CVE-2026-97034 12 saat önce

Arbitrary command execution via GCC spec files in cgo linker search directories in cmd/go

Go toolchain cmd/go

When using GCC, building a malicious package that uses cgo could cause arbitrary command execution at link time via untrusted GCC spec files ("specs" or "*.spec"). When linking with "-fopenmp", "-fopenacc", or "-fsanitize=" in "#cgo LDFLAGS", GCC's built-in l…

Puansız

CVE-2026-97054 12 saat önce

HTTP/1 server crash due to MaxBytesReader header race in net/http

Go standard library net/http

For HTTP/1 servers, when MaxBytesReader's limit is exceeded, "Connection: close" header is automatically set without synchronization, which might race with another header being set explicitly in the server handler. As a result, an HTTP/1 server that utilizes …

Puansız

CVE-2026-97035 12 saat önce

Unexpected code execution and arbitrary file write via Clang -gen-* and GCC -gnat* flags in cgo in cmd/go

Go toolchain cmd/go

When using Clang or GCC, building a malicious package that uses cgo could cause unexpected code execution at build time or write files to arbitrary directories via "-gen-*" or "-gnat*" flags in "#cgo" directives. The "-g*" wildcard in the compiler and linker …

Puansız

CVE-2026-97036 12 saat önce

Arbitrary code execution during build on darwin via "-l to_library" in cgo in cmd/go

Go toolchain cmd/go

On Darwin, building a malicious package that uses cgo could cause arbitrary code execution when using the Apple linker due to passing "-l to_library <path>" in a "#cgo LDFLAGS" directive. The Apple linker recombines the separated arguments "-l" and "to_librar…

Puansız

CVE-2026-97037 12 saat önce

Linker script injection via split -Wl, flags and Darwin or symbol linker flags in cgo in cmd/go

Go toolchain cmd/go

Building a malicious package that uses cgo could cause arbitrary code execution at link time by passing linker script files to the host linker via "#cgo LDFLAGS". Split "-Wl," flags that consume a following argument (such as "-Wl,-rpath", "-Wl,--just-symbols"…