CVE-2025-68119

Name of the Vulnerable Software and Affected Versions Go (affected versions not specified)

Description A flaw exists where downloading and building modules with malicious version strings can lead to local code execution. Systems utilizing Mercurial (hg) are susceptible to unexpected code execution when downloading modules from non-standard sources, stemming from the construction of external VCS commands. This issue can also be triggered by supplying malicious version strings directly to the toolchain. On systems with Git installed, malicious version strings can enable an attacker to write to arbitrary files on the filesystem, but this requires explicitly providing the malicious strings and does not impact usage of @latest or bare module paths. The issue relates to unexpected code execution when invoking the toolchain.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.