CVE-2025-4674

NameCVE-2025-4674
DescriptionThe go command may execute unexpected commands when operating in untrusted VCS repositories. This occurs when possibly dangerous VCS configuration is present in repositories. This can happen when a repository was fetched via one VCS (e.g. Git), but contains metadata for another VCS (e.g. Mercurial). Modules which are retrieved using the go command line, i.e. via "go get", are not affected.
SourceCVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
Debian Bugs1109109, 1109110

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
golang-1.15 (PTS)bullseye1.15.15-1~deb11u4vulnerable
golang-1.19 (PTS)bookworm1.19.8-2vulnerable
golang-1.23 (PTS)sid1.23.10-1vulnerable
golang-1.24 (PTS)forky, trixie1.24.4-1vulnerable
sid1.24.4-3vulnerable

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
golang-1.15source(unstable)(unfixed)
golang-1.19source(unstable)(unfixed)
golang-1.23source(unstable)(unfixed)1109110
golang-1.24source(unstable)(unfixed)1109109

Notes

[trixie] - golang-1.24 <no-dsa> (Minor issue)
[bookworm] - golang-1.19 <no-dsa> (Minor issue)
[bullseye] - golang-1.15 <postponed> (Minor issue)
https://groups.google.com/g/golang-announce/c/gTNJnDXmn34
https://github.com/golang/go/commit/825eeee3f789a11231ce23a4836c74ec5e34bf2a (go1.24.5)
https://github.com/golang/go/commit/e9d2c032b14c17083be0f8f0c822565199d2994f (go1.23.11)
https://github.com/golang/go/issues/74380

Search for package or bug name: Reporting problems