{"cve":"CVE-2025-4674","nvd":{"published":"2025-07-29T22:15:25.380","modified":"2026-06-17T09:33:46.027","status":"Analyzed","description":"The go command may execute unexpected commands when operating in untrusted VCS repositories. This occurs when possibly dangerous VCS configuration is present in repositories. This can happen when a repository was fetched via one VCS (e.g. Git), but contains metadata for another VCS (e.g. Mercurial). Modules which are retrieved using the go command line, i.e. via \"go get\", are not affected.","cvss_v4":null,"cvss_v3":{"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","score":8.6},"cwes":["CWE-73"],"references":["https://go.dev/cl/686515","https://go.dev/issue/74380","https://groups.google.com/g/golang-announce/c/gTNJnDXmn34","https://pkg.go.dev/vuln/GO-2025-3828","http://www.openwall.com/lists/oss-security/2025/07/08/5"],"products":["golang:go"],"source":"nvd","synced_at":"2026-10-19T22:05:46.678065081+00:00"},"epss":{"cve":"CVE-2025-4674","score":0.00475,"percentile":0.41084,"date":"2026-10-31"},"kev":null,"osv":[{"id":"GO-2025-3828","url":"https://osv.dev/vulnerability/GO-2025-3828","summary":"Unexpected command execution in untrusted VCS repositories in cmd/go","modified":"2026-02-04T03:33:13.542630Z","packages":[{"ecosystem":"Go","name":"toolchain","purl":"pkg:golang/toolchain","ranges":["<1.23.11",">=1.24.0-0 <1.24.5"],"fixed":["1.23.11","1.24.5"]}]}],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}