8.6

CVE-2025-4674: go toolchain cmd/go External Control of File Name or Path

CVSS: 8.6v3.1HighAnalyzed
AliasesMGASA-2025-0205SUSE-SU-2025:02295-1SUSE-SU-2025:02296-1
Published 29-07-2025Last modified 04-11-2025
Open JSON

Vulnerability summary

CVE-2025-4674 is a high (CVSS 8.6) External Control of File Name or Path vulnerability in go toolchain cmd/go. EPSS estimates a 0.44% chance of exploitation in the next 30 days, higher than 37.1% of scored vulnerabilities.

Overall risk
34/100
0100
Medium · default modelHow is this calculated?
CVSS score
8.6/10
010
High · v3.1 (CVE.org)
EPSS score
0.44%
0%100%
Low · +0.17 pp in 30 days
KEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 12 · Related 15
OPENSUSE-SU-2025:15405-1RHSA-2025:13935RHSA-2025:13941SUSE-SU-2025:02812-1SUSE-SU-2025:02837-1SUSE-SU-2025:02924-1

Timeline

  1. 29-07-2025
    PublishedVulnerability first disclosed.
  2. 04-11-2025
    Last modifiedVulnerability information updated.

Description

The go command may execute unexpected commands when operating in untrusted VCS repositories. This occurs when possibly dangerous VCS configuration is present in repositories. This can happen when a repository was fetched via one VCS (e.g. Git), but contains metadata for another VCS (e.g. Mercurial). Modules which are retrieved using the go command line, i.e. via "go get", are not affected.

CVSS metrics

7 scores · 7 sources · 1 version

EPSS trend

Probability

0.44%

Chance of exploitation in the next 30 days

Percentile

37%

Versus all other CVEs

30-day change

+0.17 pp

From 0.27% on 20-09-2026

20-09-202620-10-2026
EPSS score
0.44%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

Affected systems

Suse28 products
  • go1.23&distro=SUSE Enterprise Storage 7.1< 1.23.11-150000.1.37.1
  • go1.23&distro=SUSE Linux Enterprise High Performance Computing 15 SP3-LTSS< 1.23.11-150000.1.37.1
  • go1.23&distro=SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS< 1.23.11-150000.1.37.1
  • go1.23&distro=SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS< 1.23.11-150000.1.37.1
  • go1.23&distro=SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS< 1.23.11-150000.1.37.1
Chainguard20 products
  • agentbeat< 9.1.0-r3
  • go-1.20All versions (No fix recorded)
  • go-1.22All versions (No fix recorded)
  • katib-earlystopping< 0.19.0-r31
  • katib-suggestion-goptuna-compatAll versions (No fix recorded)
Wolfi13 products
  • go-1.20All versions (No fix recorded)
  • go-1.22All versions (No fix recorded)
  • katib-earlystopping< 0.19.0-r31
  • katib-suggestion-goptuna-compatAll versions (No fix recorded)
  • katib-suggestion-hyperband< 0.19.0-r31
Redhat11 products
  • delve< 0:1.24.1-1.module+el8.10.0+22945+b2c96a17 | < 0:1.9.1-1.module+el8.8.0+16778+5fbb74f5
  • delve-debuginfo< 0:1.24.1-1.module+el8.10.0+22945+b2c96a17 | < 0:1.9.1-1.module+el8.8.0+16778+5fbb74f5
  • delve-debugsource< 0:1.24.1-1.module+el8.10.0+22945+b2c96a17 | < 0:1.9.1-1.module+el8.8.0+16778+5fbb74f5
  • go-toolset< 0:1.21.13-10.el9_4 | < 0:1.24.6-1.module+el8.10.0+23407+428597c7 | < 0:1.19.13-3.module+el8.8.0+22903+37387f31
  • golang< 0:1.21.13-10.el9_4 | < 0:1.19.13-18.el9_2 | < 0:1.24.6-1.module+el8.10.0+23407+428597c7 | < 0:1.19.13-16.module+el8.8.0+23410+958e78d9
Ubuntu7 products
  • golang-1.18All versions (No fix recorded)
  • golang-1.20All versions (No fix recorded)
  • golang-1.21All versions (No fix recorded)
  • golang-1.22All versions (No fix recorded)
  • golang-1.23All versions (No fix recorded)
Opensuse5 products
  • go1.23&distro=openSUSE Leap 15.6< 1.23.11-150000.1.37.1
  • go1.23&distro=openSUSE Tumbleweed< 1.23.11-1.1
  • go1.24&distro=openSUSE Leap 15.6< 1.24.5-150000.1.29.1
  • go1.24&distro=openSUSE Tumbleweed< 1.24.5-1.1
  • go1.25&distro=openSUSE Tumbleweed< 1.25rc2-1.1
Debian2 products
  • golang-1.19All versions (No fix recorded)
  • golang-1.24All versions (No fix recorded)
Go1 product
  • toolchain≥ 1.24.0-0, < 1.24.5
Go toolchain1 product
  • cmd/go< 1.23.11 | ≥ 1.24.0-0, < 1.24.5
Golang1 product
  • go< 1.23.11 | ≥ 1.24.0, < 1.24.5
Mageia1 product
  • golang< 1.24.5-1.mga9

11 vendors · 90 products

References

34 links
Show all 34 references