Read the docs
TI-2025-04172 Aliases CVE-2025-4674GHSA-wprm-fgrx-xj42

Unexpected command execution in untrusted VCS repositories in cmd/go

Priority MEDIUM 40CWE-73Published · Updated

Key facts

Attack vector
Local
Privileges required
None
User interaction
Required
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA and Red Hat.

Summary

The go command may execute unexpected commands when operating in untrusted VCS repositories. This occurs when possibly dangerous VCS configuration is present in repositories. This can happen when a repository was fetched via one VCS (e.g. Git), but contains metadata for another VCS (e.g. Mercurial). Modules which are retrieved using the go command line, i.e. via "go get", are not affected.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00475 41st percentileScored 2026-11-07
Fix Fixed cmd/go (Go toolchain): 1.23.11, 1.24.5Red Hat: 6 advisories

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
Go standard librarycmd/gobefore 1.23.11; 1.24.0-0 to before 1.24.51.23.11, 1.24.5Patch availableCNA
  • cmd/go VendorGo standard library Affected before 1.23.11; 1.24.0-0 to before 1.24.5 Fixed in 1.23.11, 1.24.5 Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:golang:go:*:*:*:*:*:*:*:*before 1.23.11; 1.24.0 to before 1.24.5VulnerableGo standard library
  • cpe:2.3:a:golang:go:*:*:*:*:*:*:*:* Versions before 1.23.11; 1.24.0 to before 1.24.5 Vulnerable ·Go standard library

Remediation

  • Fix · CNA cmd/go (Go toolchain) Fixed in 1.23.11, 1.24.5

Red Hat 6 advisories

  • RHSA-2025:14093 Released 2025-08-19 · Red Hat rating Important
    go-toolset:rhel8 security update
    • Red Hat Enterprise Linux AppStream E4S (v.8.8) delve-1.9.1-1.module+el8.8.0+16778+5fbb74f5.src::go-toolset:rhel8, delve-1.9.1-1.module+el8.8.0+16778+5fbb74f5.x86_64::go-toolset:rhel8, go-toolset-1.19.13-3.module+el8.8.0+22903+37387f31.ppc64le::go-toolset:rhel8 +12
    • Red Hat Enterprise Linux AppStream TUS (v.8.8) delve-1.9.1-1.module+el8.8.0+16778+5fbb74f5.src::go-toolset:rhel8, delve-1.9.1-1.module+el8.8.0+16778+5fbb74f5.x86_64::go-toolset:rhel8, go-toolset-1.19.13-3.module+el8.8.0+22903+37387f31.src::go-toolset:rhel8 +9
  • RHSA-2025:13935 Released 2025-08-18 · Red Hat rating Important
    golang security update
    • Red Hat Enterprise Linux AppStream (v. 9) go-toolset-1.24.6-1.el9_6, golang-1.24.6-1.el9_6, golang-bin-1.24.6-1.el9_6 +5
  • RHSA-2025:13940 Released 2025-08-18 · Red Hat rating Important
    go-toolset:rhel8 security update
    • Red Hat Enterprise Linux AppStream (v. 8) delve-1.24.1-1.module+el8.10.0+22945+b2c96a17.aarch64::go-toolset:rhel8, delve-1.24.1-1.module+el8.10.0+22945+b2c96a17.ppc64le::go-toolset:rhel8, delve-1.24.1-1.module+el8.10.0+22945+b2c96a17.src::go-toolset:rhel8 +19
Show 3 more Red Hat advisories
  • RHSA-2025:13941 Released 2025-08-18 · Red Hat rating Important
    golang security update
    • Red Hat Enterprise Linux AppStream (v. 10) go-toolset-1.24.6-1.el10_0, golang-1.24.6-1.el10_0, golang-bin-1.24.6-1.el10_0 +5
  • RHSA-2025:13936 Released 2025-08-18 · Red Hat rating Important
    golang security update
    • Red Hat Enterprise Linux AppStream EUS (v.9.4) go-toolset-1.21.13-10.el9_4, golang-1.21.13-10.el9_4, golang-bin-1.21.13-10.el9_4 +4
  • RHSA-2025:13939 Released 2025-08-18 · Red Hat rating Important
    golang security update
    • Red Hat Enterprise Linux AppStream E4S (v.9.2) golang-1.19.13-18.el9_2, golang-bin-1.19.13-18.el9_2, golang-docs-1.19.13-18.el9_2 +4

Vendor assessments

Red Hat

Red Hat rating: Important. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Enterprise Linux AppStream (v. 10)Fixed RHSA-2025:13941
Red Hat Enterprise Linux AppStream (v. 8)Fixed RHSA-2025:13940
Red Hat Enterprise Linux AppStream (v. 9)Fixed RHSA-2025:13935
Red Hat Enterprise Linux AppStream E4S (v.8.8)Fixed RHSA-2025:14093
Red Hat Enterprise Linux AppStream E4S (v.9.2)Fixed RHSA-2025:13939
Red Hat Enterprise Linux AppStream EUS (v.9.4)Fixed RHSA-2025:13936
Red Hat Enterprise Linux AppStream TUS (v.8.8)Fixed RHSA-2025:14093

Timeline

  1. 2026-10-02 Threatist record created from CVE-2025-4674
  2. 2026-10-03 Alias added: GHSA-wprm-fgrx-xj42
  3. 2026-10-19 Priority changed: LOW → MEDIUM

References

Patch 1

Advisory 2

Other 1

  • TI-2020-00578 Improper certificate validation in Microsoft Windows KEVCVSS 3.1HIGH 8.1
  • TI-2023-23979 The HTTP/2 protocol allows a denial of service (server resource consumption) because… KEVCVSS 3.1HIGH 7.5
  • TI-2018-05208 The "go get" implementation in Go 1.9.4, when the -insecure command-line option is used… CVSS 3.1HIGH 8.8
  • TI-2018-12083 Improper input validation in [UNKNOWN] golang CVSS 3.1HIGH 8.1
  • TI-2024-16306 Mishandling of corrupt central directory record in archive/zip CVSS 3.1MEDIUM 5.5
  • TI-2021-15910 Go before 1.16.9 and 1.17.x before 1.17.2 has a Buffer Overflow via large arguments in a… CVSS 3.1CRITICAL 9.8
See all 170 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences