← Zuruck zu CVEs

CVE-2025-4674

HIGH

8.6

Beschreibung

The go command may execute unexpected commands when operating in untrusted VCS repositories. This occurs when possibly dangerous VCS configuration is present in repositories. This can happen when a repository was fetched via one VCS (e.g. Git), but contains metadata for another VCS (e.g. Mercurial). Modules which are retrieved using the go command line, i.e. via "go get", are not affected.

CVE Details

CVSS v3.1 Bewertung8.6

SchweregradHIGH

CVSS VektorCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

AngriffsvektorLOCAL

KomplexitatLOW

Erforderliche PrivilegienNONE

BenutzerinteraktionREQUIRED

Veroffentlicht7/29/2025

Zuletzt geandert1/29/2026

Quellenvd

Honeypot-Sichtungen0

Betroffene Produkte

golang:go

Schwachen (CWE)

CWE-73

Referenzen

https://go.dev/cl/686515(security@golang.org)

https://go.dev/issue/74380(security@golang.org)

https://groups.google.com/g/golang-announce/c/gTNJnDXmn34(security@golang.org)

https://pkg.go.dev/vuln/GO-2025-3828(security@golang.org)

http://www.openwall.com/lists/oss-security/2025/07/08/5(af854a3a-2127-422b-91ae-364da2661108)

IOC Korrelationen

Keine Korrelationen erfasst

This product uses data from the NVD API but is not endorsed or certified by the NVD.