GO-2025-3828

See a problem?
Please try reporting it to the source first.

Source

https://pkg.go.dev/vuln/GO-2025-3828

Import Source

https://vuln.go.dev/ID/GO-2025-3828.json

JSON Data

https://api.test.osv.dev/v1/vulns/GO-2025-3828

Aliases

Published

2025-07-29T21:02:00Z

Modified

2025-07-31T06:59:22.992600Z

Summary

Unexpected command execution in untrusted VCS repositories in cmd/go

Details

The go command may execute unexpected commands when operating in untrusted VCS repositories.

This occurs when possibly dangerous VCS configuration is present in repositories. This can happen when a repository was fetched via one VCS (e.g. Git), but contains metadata for another VCS (e.g. Mercurial). Modules which are retrieved using the go command line, i.e. via "go get", are not affected.

Database specific

{
    "url": "https://pkg.go.dev/vuln/GO-2025-3828",
    "review_status": "REVIEWED"
}

References

Credits

- RyotaK (https://ryotak.net) of GMO Flatt Security Inc

Affected packages

Go / toolchain

Package

Name: toolchain; View open source insights on deps.dev
Purl: pkg:golang/toolchain

Affected ranges

Type: SEMVER
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

1.23.11

Introduced

1.24.0-0

Fixed

1.24.5

Ecosystem specific

{
    "imports": [
        {
            "path": "cmd/go"
        }
    ]
}