BIT-golang-2025-4674

See a problem?
Import Source
https://github.com/bitnami/vulndb/tree/main/data/golang/BIT-golang-2025-4674.json
JSON Data
https://api.test.osv.dev/v1/vulns/BIT-golang-2025-4674
Aliases
Published
2025-07-31T05:44:23.042Z
Modified
2025-07-31T06:59:22.992600Z
Summary
Unexpected command execution in untrusted VCS repositories in cmd/go
Details

The go command may execute unexpected commands when operating in untrusted VCS repositories. This occurs when possibly dangerous VCS configuration is present in repositories. This can happen when a repository was fetched via one VCS (e.g. Git), but contains metadata for another VCS (e.g. Mercurial). Modules which are retrieved using the go command line, i.e. via "go get", are not affected.

Database specific
{
    "cpes": [
        "cpe:2.3:a:golang:go:*:*:*:*:*:*:*:*"
    ],
    "severity": "Unknown"
}
References

Affected packages

Bitnami / golang

Package

Name
golang
Purl
pkg:bitnami/golang

Affected ranges

Type
SEMVER
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
1.23.11
Introduced
1.24.0-0
Fixed
1.24.5