CVE-2025-4674
High
Description
The go command may execute unexpected commands when operating in untrusted VCS repositories. This occurs when possibly dangerous VCS configuration is present in repositories. This can happen when a repository was fetched via one VCS (e.g. Git), but contains metadata for another VCS (e.g. Mercurial). Modules which are retrieved using the go command line, i.e. via "go get", are not affected.
SeverityHigh
CVSS8.6
Exploit probability—
ProductGo
PublishedJul 29, 2025
First seenJul 29, 2025
Weakness typeCWE-73CWE-73
How to fix
Update
- golang go1.23.11, 1.24.5 or later
- toolchain1.23.11, 1.24.5 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| golang go | v < 1.23.11, 1.24.0 ≤ v < 1.24.5 | 1.23.11, 1.24.5 |
| toolchainGo | v < 1.23.11, 1.24.0-0 ≤ v < 1.24.5 | 1.23.11, 1.24.5 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.