High severity8.6NVD Advisory· Published Jul 29, 2025· Updated Jun 17, 2026

CVE-2025-4674

Description

The go command may execute unexpected commands when operating in untrusted VCS repositories. This occurs when possibly dangerous VCS configuration is present in repositories. This can happen when a repository was fetched via one VCS (e.g. Git), but contains metadata for another VCS (e.g. Mercurial). Modules which are retrieved using the go command line, i.e. via "go get", are not affected.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

137

Golang/Go
cpe:2.3:a:golang:go:*:*:*:*:*:*:*:*
Range: <1.23.11
Go/go commandllm-fuzzy
osv-coords134 versions
pkg:apk/chainguard/agentbeat pkg:apk/chainguard/falco pkg:apk/chainguard/falco-dev pkg:apk/chainguard/falco-src pkg:apk/chainguard/katib-earlystopping pkg:apk/chainguard/katib-suggestion-hyperband pkg:apk/chainguard/katib-suggestion-hyperopt pkg:apk/chainguard/katib-suggestion-nas-darts pkg:apk/chainguard/katib-suggestion-nas-enas pkg:apk/chainguard/katib-suggestion-optuna-enas pkg:apk/chainguard/katib-suggestion-pbt-enas pkg:apk/chainguard/nemo pkg:apk/chainguard/newrelic-fluent-bit-output-compat pkg:apk/chainguard/nvidia-nsight-compute-12.8 pkg:apk/chainguard/nvidia-nsight-compute-13.0 pkg:apk/chainguard/nvidia-nsight-compute-13.1 pkg:apk/chainguard/nvidia-nsight-compute-13.2 pkg:apk/wolfi/falco pkg:apk/wolfi/falco-dev pkg:apk/wolfi/falco-src pkg:apk/wolfi/katib-earlystopping pkg:apk/wolfi/katib-suggestion-hyperband pkg:apk/wolfi/katib-suggestion-hyperopt pkg:apk/wolfi/katib-suggestion-nas-darts pkg:apk/wolfi/katib-suggestion-nas-enas pkg:apk/wolfi/katib-suggestion-optuna-enas pkg:apk/wolfi/katib-suggestion-pbt-enas pkg:apk/wolfi/newrelic-fluent-bit-output-compat pkg:bitnami/golang pkg:rpm/almalinux/delve pkg:rpm/almalinux/go-toolset pkg:rpm/almalinux/golang pkg:rpm/almalinux/golang-bin pkg:rpm/almalinux/golang-docs pkg:rpm/almalinux/golang-misc pkg:rpm/almalinux/golang-race pkg:rpm/almalinux/golang-src pkg:rpm/almalinux/golang-tests pkg:rpm/opensuse/go1.23&distro=openSUSE%20Leap%2015.6 pkg:rpm/opensuse/go1.23&distro=openSUSE%20Tumbleweed pkg:rpm/opensuse/go1.23-openssl&distro=openSUSE%20Leap%2015.6 pkg:rpm/opensuse/go1.24&distro=openSUSE%20Leap%2015.6 pkg:rpm/opensuse/go1.24&distro=openSUSE%20Tumbleweed pkg:rpm/opensuse/go1.24-openssl&distro=openSUSE%20Leap%2015.6 pkg:rpm/opensuse/go1.25&distro=openSUSE%20Leap%2015.6 pkg:rpm/opensuse/go1.25&distro=openSUSE%20Tumbleweed pkg:rpm/opensuse/go1.25-openssl&distro=openSUSE%20Leap%2015.6 pkg:rpm/opensuse/govulncheck-vulndb&distro=openSUSE%20Tumbleweed pkg:rpm/suse/go1.23&distro=SUSE%20Enterprise%20Storage%207.1 pkg:rpm/suse/go1.23&distro=SUSE%20Linux%20Enterprise%20High%20Performance%20Computing%2015%20SP3-LTSS pkg:rpm/suse/go1.23&distro=SUSE%20Linux%20Enterprise%20High%20Performance%20Computing%2015%20SP4-ESPOS pkg:rpm/suse/go1.23&distro=SUSE%20Linux%20Enterprise%20High%20Performance%20Computing%2015%20SP4-LTSS pkg:rpm/suse/go1.23&distro=SUSE%20Linux%20Enterprise%20High%20Performance%20Computing%2015%20SP5-ESPOS pkg:rpm/suse/go1.23&distro=SUSE%20Linux%20Enterprise%20High%20Performance%20Computing%2015%20SP5-LTSS pkg:rpm/suse/go1.23&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Development%20Tools%2015%20SP6 pkg:rpm/suse/go1.23&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Development%20Tools%2015%20SP7 pkg:rpm/suse/go1.23&distro=SUSE%20Linux%20Enterprise%20Server%2015%20SP3-LTSS pkg:rpm/suse/go1.23&distro=SUSE%20Linux%20Enterprise%20Server%2015%20SP4-LTSS pkg:rpm/suse/go1.23&distro=SUSE%20Linux%20Enterprise%20Server%2015%20SP5-LTSS pkg:rpm/suse/go1.23&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2015%20SP3 pkg:rpm/suse/go1.23&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2015%20SP4 pkg:rpm/suse/go1.23&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2015%20SP5 pkg:rpm/suse/go1.23-openssl&distro=SUSE%20Enterprise%20Storage%207.1 pkg:rpm/suse/go1.23-openssl&distro=SUSE%20Linux%20Enterprise%20High%20Performance%20Computing%2015%20SP3-LTSS pkg:rpm/suse/go1.23-openssl&distro=SUSE%20Linux%20Enterprise%20High%20Performance%20Computing%2015%20SP4-ESPOS pkg:rpm/suse/go1.23-openssl&distro=SUSE%20Linux%20Enterprise%20High%20Performance%20Computing%2015%20SP4-LTSS pkg:rpm/suse/go1.23-openssl&distro=SUSE%20Linux%20Enterprise%20High%20Performance%20Computing%2015%20SP5-ESPOS pkg:rpm/suse/go1.23-openssl&distro=SUSE%20Linux%20Enterprise%20High%20Performance%20Computing%2015%20SP5-LTSS pkg:rpm/suse/go1.23-openssl&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Development%20Tools%2015%20SP6 pkg:rpm/suse/go1.23-openssl&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Development%20Tools%2015%20SP7 pkg:rpm/suse/go1.23-openssl&distro=SUSE%20Linux%20Enterprise%20Server%2015%20SP3-LTSS pkg:rpm/suse/go1.23-openssl&distro=SUSE%20Linux%20Enterprise%20Server%2015%20SP4-LTSS pkg:rpm/suse/go1.23-openssl&distro=SUSE%20Linux%20Enterprise%20Server%2015%20SP5-LTSS pkg:rpm/suse/go1.23-openssl&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2015%20SP3 pkg:rpm/suse/go1.23-openssl&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2015%20SP4 pkg:rpm/suse/go1.23-openssl&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2015%20SP5 pkg:rpm/suse/go1.24&distro=SUSE%20Enterprise%20Storage%207.1 pkg:rpm/suse/go1.24&distro=SUSE%20Linux%20Enterprise%20High%20Performance%20Computing%2015%20SP3-LTSS pkg:rpm/suse/go1.24&distro=SUSE%20Linux%20Enterprise%20High%20Performance%20Computing%2015%20SP4-ESPOS pkg:rpm/suse/go1.24&distro=SUSE%20Linux%20Enterprise%20High%20Performance%20Computing%2015%20SP4-LTSS pkg:rpm/suse/go1.24&distro=SUSE%20Linux%20Enterprise%20High%20Performance%20Computing%2015%20SP5-ESPOS pkg:rpm/suse/go1.24&distro=SUSE%20Linux%20Enterprise%20High%20Performance%20Computing%2015%20SP5-LTSS pkg:rpm/suse/go1.24&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Development%20Tools%2015%20SP6 pkg:rpm/suse/go1.24&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Development%20Tools%2015%20SP7 pkg:rpm/suse/go1.24&distro=SUSE%20Linux%20Enterprise%20Server%2015%20SP3-LTSS pkg:rpm/suse/go1.24&distro=SUSE%20Linux%20Enterprise%20Server%2015%20SP4-LTSS pkg:rpm/suse/go1.24&distro=SUSE%20Linux%20Enterprise%20Server%2015%20SP5-LTSS pkg:rpm/suse/go1.24&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2015%20SP3 pkg:rpm/suse/go1.24&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2015%20SP4 pkg:rpm/suse/go1.24&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2015%20SP5 pkg:rpm/suse/go1.24-openssl&distro=SUSE%20Enterprise%20Storage%207.1 pkg:rpm/suse/go1.24-openssl&distro=SUSE%20Linux%20Enterprise%20High%20Performance%20Computing%2015%20SP3-LTSS pkg:rpm/suse/go1.24-openssl&distro=SUSE%20Linux%20Enterprise%20High%20Performance%20Computing%2015%20SP4-ESPOS pkg:rpm/suse/go1.24-openssl&distro=SUSE%20Linux%20Enterprise%20High%20Performance%20Computing%2015%20SP4-LTSS pkg:rpm/suse/go1.24-openssl&distro=SUSE%20Linux%20Enterprise%20High%20Performance%20Computing%2015%20SP5-ESPOS pkg:rpm/suse/go1.24-openssl&distro=SUSE%20Linux%20Enterprise%20High%20Performance%20Computing%2015%20SP5-LTSS pkg:rpm/suse/go1.24-openssl&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Development%20Tools%2015%20SP6 pkg:rpm/suse/go1.24-openssl&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Development%20Tools%2015%20SP7 pkg:rpm/suse/go1.24-openssl&distro=SUSE%20Linux%20Enterprise%20Server%2015%20SP3-LTSS pkg:rpm/suse/go1.24-openssl&distro=SUSE%20Linux%20Enterprise%20Server%2015%20SP4-LTSS pkg:rpm/suse/go1.24-openssl&distro=SUSE%20Linux%20Enterprise%20Server%2015%20SP5-LTSS pkg:rpm/suse/go1.24-openssl&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2015%20SP3 pkg:rpm/suse/go1.24-openssl&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2015%20SP4 pkg:rpm/suse/go1.24-openssl&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2015%20SP5 pkg:rpm/suse/go1.25&distro=SUSE%20Enterprise%20Storage%207.1 pkg:rpm/suse/go1.25&distro=SUSE%20Linux%20Enterprise%20High%20Performance%20Computing%2015%20SP3-LTSS pkg:rpm/suse/go1.25&distro=SUSE%20Linux%20Enterprise%20High%20Performance%20Computing%2015%20SP4-ESPOS pkg:rpm/suse/go1.25&distro=SUSE%20Linux%20Enterprise%20High%20Performance%20Computing%2015%20SP4-LTSS pkg:rpm/suse/go1.25&distro=SUSE%20Linux%20Enterprise%20High%20Performance%20Computing%2015%20SP5-ESPOS pkg:rpm/suse/go1.25&distro=SUSE%20Linux%20Enterprise%20High%20Performance%20Computing%2015%20SP5-LTSS pkg:rpm/suse/go1.25&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Development%20Tools%2015%20SP6 pkg:rpm/suse/go1.25&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Development%20Tools%2015%20SP7 pkg:rpm/suse/go1.25&distro=SUSE%20Linux%20Enterprise%20Server%2015%20SP3-LTSS pkg:rpm/suse/go1.25&distro=SUSE%20Linux%20Enterprise%20Server%2015%20SP4-LTSS pkg:rpm/suse/go1.25&distro=SUSE%20Linux%20Enterprise%20Server%2015%20SP5-LTSS pkg:rpm/suse/go1.25&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2015%20SP3 pkg:rpm/suse/go1.25&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2015%20SP4 pkg:rpm/suse/go1.25&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2015%20SP5 pkg:rpm/suse/go1.25-openssl&distro=SUSE%20Enterprise%20Storage%207.1 pkg:rpm/suse/go1.25-openssl&distro=SUSE%20Linux%20Enterprise%20High%20Performance%20Computing%2015%20SP3-LTSS pkg:rpm/suse/go1.25-openssl&distro=SUSE%20Linux%20Enterprise%20High%20Performance%20Computing%2015%20SP4-ESPOS pkg:rpm/suse/go1.25-openssl&distro=SUSE%20Linux%20Enterprise%20High%20Performance%20Computing%2015%20SP4-LTSS pkg:rpm/suse/go1.25-openssl&distro=SUSE%20Linux%20Enterprise%20High%20Performance%20Computing%2015%20SP5-ESPOS pkg:rpm/suse/go1.25-openssl&distro=SUSE%20Linux%20Enterprise%20High%20Performance%20Computing%2015%20SP5-LTSS pkg:rpm/suse/go1.25-openssl&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Development%20Tools%2015%20SP6 pkg:rpm/suse/go1.25-openssl&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Development%20Tools%2015%20SP7 pkg:rpm/suse/go1.25-openssl&distro=SUSE%20Linux%20Enterprise%20Server%2015%20SP3-LTSS pkg:rpm/suse/go1.25-openssl&distro=SUSE%20Linux%20Enterprise%20Server%2015%20SP4-LTSS pkg:rpm/suse/go1.25-openssl&distro=SUSE%20Linux%20Enterprise%20Server%2015%20SP5-LTSS pkg:rpm/suse/go1.25-openssl&distro=SUSE%20Linux%20Enterprise%20Server%2015%20SP6-LTSS pkg:rpm/suse/go1.25-openssl&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2015%20SP3 pkg:rpm/suse/go1.25-openssl&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2015%20SP4 pkg:rpm/suse/go1.25-openssl&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2015%20SP5 pkg:rpm/suse/go1.25-openssl&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2015%20SP6
< 9.1.0-r3+ 133 more
- (no CPE)range: < 9.1.0-r3
- (no CPE)range: < 0.42.0-r0
- (no CPE)range: < 0.42.0-r0
- (no CPE)range: < 0.42.0-r0
- (no CPE)range: < 0.19.0-r31
- (no CPE)range: < 0.19.0-r31
- (no CPE)range: < 0.19.0-r31
- (no CPE)range: < 0.19.0-r31
- (no CPE)range: < 0.19.0-r31
- (no CPE)range: < 0.19.0-r31
- (no CPE)range: < 0.19.0-r31
- (no CPE)range: < 2.5.2-r2
- (no CPE)range: < 2.4.0-r5
- (no CPE)range: < 2025.1.1.2-r8
- (no CPE)range: < 2025.3.0.19-r2
- (no CPE)range: < 2025.4.1.2-r1
- (no CPE)range: < 2026.1.1.2-r0
- (no CPE)range: < 0.42.0-r0
- (no CPE)range: < 0.42.0-r0
- (no CPE)range: < 0.42.0-r0
- (no CPE)range: < 0.19.0-r31
- (no CPE)range: < 0.19.0-r31
- (no CPE)range: < 0.19.0-r31
- (no CPE)range: < 0.19.0-r31
- (no CPE)range: < 0.19.0-r31
- (no CPE)range: < 0.19.0-r31
- (no CPE)range: < 0.19.0-r31
- (no CPE)range: < 2.4.0-r5
- (no CPE)range: < 1.23.11
- (no CPE)range: < 1.24.1-1.module_el8.10.0+3977+66935a26
- (no CPE)range: < 1.24.6-1.el9_6
- (no CPE)range: < 1.24.6-1.el9_6
- (no CPE)range: < 1.24.6-1.el9_6
- (no CPE)range: < 1.24.6-1.el9_6
- (no CPE)range: < 1.24.6-1.el9_6
- (no CPE)range: < 1.24.6-1.el9_6
- (no CPE)range: < 1.24.6-1.el9_6
- (no CPE)range: < 1.24.6-1.el9_6
- (no CPE)range: < 1.23.11-150000.1.37.1
- (no CPE)range: < 1.23.11-1.1
- (no CPE)range: < 1.23.12-150600.13.9.1
- (no CPE)range: < 1.24.5-150000.1.29.1
- (no CPE)range: < 1.24.5-1.1
- (no CPE)range: < 1.24.6-150600.13.9.1
- (no CPE)range: < 1.25.0-150000.1.5.1
- (no CPE)range: < 1.25rc2-1.1
- (no CPE)range: < 1.25.0-150600.13.3.1
- (no CPE)range: < 0.0.20250730T213748-1.1
- (no CPE)range: < 1.23.11-150000.1.37.1
- (no CPE)range: < 1.23.11-150000.1.37.1
- (no CPE)range: < 1.23.11-150000.1.37.1
- (no CPE)range: < 1.23.11-150000.1.37.1
- (no CPE)range: < 1.23.11-150000.1.37.1
- (no CPE)range: < 1.23.11-150000.1.37.1
- (no CPE)range: < 1.23.11-150000.1.37.1
- (no CPE)range: < 1.23.11-150000.1.37.1
- (no CPE)range: < 1.23.11-150000.1.37.1
- (no CPE)range: < 1.23.11-150000.1.37.1
- (no CPE)range: < 1.23.11-150000.1.37.1
- (no CPE)range: < 1.23.11-150000.1.37.1
- (no CPE)range: < 1.23.11-150000.1.37.1
- (no CPE)range: < 1.23.11-150000.1.37.1
- (no CPE)range: < 1.23.12-150000.1.18.1
- (no CPE)range: < 1.23.12-150000.1.18.1
- (no CPE)range: < 1.23.12-150000.1.18.1
- (no CPE)range: < 1.23.12-150000.1.18.1
- (no CPE)range: < 1.23.12-150000.1.18.1
- (no CPE)range: < 1.23.12-150000.1.18.1
- (no CPE)range: < 1.23.12-150600.13.9.1
- (no CPE)range: < 1.23.12-150600.13.9.1
- (no CPE)range: < 1.23.12-150000.1.18.1
- (no CPE)range: < 1.23.12-150000.1.18.1
- (no CPE)range: < 1.23.12-150000.1.18.1
- (no CPE)range: < 1.23.12-150000.1.18.1
- (no CPE)range: < 1.23.12-150000.1.18.1
- (no CPE)range: < 1.23.12-150000.1.18.1
- (no CPE)range: < 1.24.5-150000.1.29.1
- (no CPE)range: < 1.24.5-150000.1.29.1
- (no CPE)range: < 1.24.5-150000.1.29.1
- (no CPE)range: < 1.24.5-150000.1.29.1
- (no CPE)range: < 1.24.5-150000.1.29.1
- (no CPE)range: < 1.24.5-150000.1.29.1
- (no CPE)range: < 1.24.5-150000.1.29.1
- (no CPE)range: < 1.24.5-150000.1.29.1
- (no CPE)range: < 1.24.5-150000.1.29.1
- (no CPE)range: < 1.24.5-150000.1.29.1
- (no CPE)range: < 1.24.5-150000.1.29.1
- (no CPE)range: < 1.24.5-150000.1.29.1
- (no CPE)range: < 1.24.5-150000.1.29.1
- (no CPE)range: < 1.24.5-150000.1.29.1
- (no CPE)range: < 1.24.6-150000.1.12.1
- (no CPE)range: < 1.24.6-150000.1.12.1
- (no CPE)range: < 1.24.6-150000.1.12.1
- (no CPE)range: < 1.24.6-150000.1.12.1
- (no CPE)range: < 1.24.6-150000.1.12.1
- (no CPE)range: < 1.24.6-150000.1.12.1
- (no CPE)range: < 1.24.6-150600.13.9.1
- (no CPE)range: < 1.24.6-150600.13.9.1
- (no CPE)range: < 1.24.6-150000.1.12.1
- (no CPE)range: < 1.24.6-150000.1.12.1
- (no CPE)range: < 1.24.6-150000.1.12.1
- (no CPE)range: < 1.24.6-150000.1.12.1
- (no CPE)range: < 1.24.6-150000.1.12.1
- (no CPE)range: < 1.24.6-150000.1.12.1
- (no CPE)range: < 1.25.0-150000.1.5.1
- (no CPE)range: < 1.25.0-150000.1.5.1
- (no CPE)range: < 1.25.0-150000.1.5.1
- (no CPE)range: < 1.25.0-150000.1.5.1
- (no CPE)range: < 1.25.0-150000.1.5.1
- (no CPE)range: < 1.25.0-150000.1.5.1
- (no CPE)range: < 1.25.0-150000.1.5.1
- (no CPE)range: < 1.25.0-150000.1.5.1
- (no CPE)range: < 1.25.0-150000.1.5.1
- (no CPE)range: < 1.25.0-150000.1.5.1
- (no CPE)range: < 1.25.0-150000.1.5.1
- (no CPE)range: < 1.25.0-150000.1.5.1
- (no CPE)range: < 1.25.0-150000.1.5.1
- (no CPE)range: < 1.25.0-150000.1.5.1
- (no CPE)range: < 1.25.0-150000.1.3.1
- (no CPE)range: < 1.25.0-150000.1.3.1
- (no CPE)range: < 1.25.0-150000.1.3.1
- (no CPE)range: < 1.25.0-150000.1.3.1
- (no CPE)range: < 1.25.0-150000.1.3.1
- (no CPE)range: < 1.25.0-150000.1.3.1
- (no CPE)range: < 1.25.0-150600.13.3.1
- (no CPE)range: < 1.25.0-150600.13.3.1
- (no CPE)range: < 1.25.0-150000.1.3.1
- (no CPE)range: < 1.25.0-150000.1.3.1
- (no CPE)range: < 1.25.0-150000.1.3.1
- (no CPE)range: < 1.25.6-150600.13.9.1
- (no CPE)range: < 1.25.0-150000.1.3.1
- (no CPE)range: < 1.25.0-150000.1.3.1
- (no CPE)range: < 1.25.0-150000.1.3.1
- (no CPE)range: < 1.25.6-150600.13.9.1
Go toolchain/cmd/gov5
Range: 0

Patches

Vulnerability mechanics

References

go.dev/cl/686515nvdPatch
go.dev/issue/74380nvdIssue TrackingThird Party Advisory
pkg.go.dev/vuln/GO-2025-3828nvdVendor Advisory
www.openwall.com/lists/oss-security/2025/07/08/5nvdMailing ListRelease Notes
groups.google.com/g/golang-announce/c/gTNJnDXmn34nvdMailing ListRelease Notes

News mentions

No linked articles in our index yet.

cvss	0.559
epss	0.000
exploit	0.000
kev	0.000
patch	-0.070
ransomware	0.000