Skip to content

Commit 85608b0

Browse files
rolandshoemakergopherbot
rolandshoemaker
authored and
gopherbot
committed
data/reports: add GO-2025-3828
 - data/reports/GO-2025-3828.yaml Updates #3828 Change-Id: I7b76329479c8433bf6061abeac4daa1dfefe21fb Reviewed-on: https://go-review.googlesource.com/c/vulndb/+/691456 Reviewed-by: Damien Neil <dneil@google.com> LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com> Auto-Submit: Roland Shoemaker <roland@golang.org> Reviewed-by: Neal Patel <nealpatel@google.com>
1 parent e6dd5be commit 85608b0

3 files changed

Lines changed: 177 additions & 0 deletions

File tree

‎data/cve/v5/GO-2025-3828.json‎

Lines changed: 74 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,74 @@
1+
{
2+
"dataType": "CVE_RECORD",
3+
"dataVersion": "5.0",
4+
"cveMetadata": {
5+
"cveId": "CVE-2025-4674"
6+
},
7+
"containers": {
8+
"cna": {
9+
"providerMetadata": {
10+
"orgId": "1bb62c36-49e3-4200-9d77-64a1400537cc"
11+
},
12+
"title": "Unexpected command execution in untrusted VCS repositories in cmd/go",
13+
"descriptions": [
14+
{
15+
"lang": "en",
16+
"value": "The go command may execute unexpected commands when operating in untrusted VCS repositories. This occurs when possibly dangerous VCS configuration is present in repositories. This can happen when a repository was fetched via one VCS (e.g. Git), but contains metadata for another VCS (e.g. Mercurial). Modules which are retrieved using the go command line, i.e. via \"go get\", are not affected."
17+
}
18+
],
19+
"affected": [
20+
{
21+
"vendor": "Go toolchain",
22+
"product": "cmd/go",
23+
"collectionURL": "https://pkg.go.dev",
24+
"packageName": "cmd/go",
25+
"versions": [
26+
{
27+
"version": "0",
28+
"lessThan": "1.23.11",
29+
"status": "affected",
30+
"versionType": "semver"
31+
},
32+
{
33+
"version": "1.24.0-0",
34+
"lessThan": "1.24.5",
35+
"status": "affected",
36+
"versionType": "semver"
37+
}
38+
],
39+
"defaultStatus": "unaffected"
40+
}
41+
],
42+
"problemTypes": [
43+
{
44+
"descriptions": [
45+
{
46+
"lang": "en",
47+
"description": "CWE-73: External Control of File Name or Path"
48+
}
49+
]
50+
}
51+
],
52+
"references": [
53+
{
54+
"url": "https://go.dev/cl/686515"
55+
},
56+
{
57+
"url": "https://go.dev/issue/74380"
58+
},
59+
{
60+
"url": "https://groups.google.com/g/golang-announce/c/gTNJnDXmn34"
61+
},
62+
{
63+
"url": "https://pkg.go.dev/vuln/GO-2025-3828"
64+
}
65+
],
66+
"credits": [
67+
{
68+
"lang": "en",
69+
"value": "RyotaK (https://ryotak.net) of GMO Flatt Security Inc"
70+
}
71+
]
72+
}
73+
}
74+
}

‎data/osv/GO-2025-3828.json‎

Lines changed: 69 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,69 @@
1+
{
2+
"schema_version": "1.3.1",
3+
"id": "GO-2025-3828",
4+
"modified": "0001-01-01T00:00:00Z",
5+
"published": "0001-01-01T00:00:00Z",
6+
"aliases": [
7+
"CVE-2025-4674",
8+
"CVE-2025-4674"
9+
],
10+
"summary": "Unexpected command execution in untrusted VCS repositories in cmd/go",
11+
"details": "The go command may execute unexpected commands when operating in untrusted VCS repositories.\n\nThis occurs when possibly dangerous VCS configuration is present in repositories. This can happen when a repository was fetched via one VCS (e.g. Git), but contains metadata for another VCS (e.g. Mercurial). Modules which are retrieved using the go command line, i.e. via \"go get\", are not affected.",
12+
"affected": [
13+
{
14+
"package": {
15+
"name": "toolchain",
16+
"ecosystem": "Go"
17+
},
18+
"ranges": [
19+
{
20+
"type": "SEMVER",
21+
"events": [
22+
{
23+
"introduced": "0"
24+
},
25+
{
26+
"fixed": "1.23.11"
27+
},
28+
{
29+
"introduced": "1.24.0-0"
30+
},
31+
{
32+
"fixed": "1.24.5"
33+
}
34+
]
35+
}
36+
],
37+
"ecosystem_specific": {
38+
"imports": [
39+
{
40+
"path": "cmd/go"
41+
}
42+
]
43+
}
44+
}
45+
],
46+
"references": [
47+
{
48+
"type": "FIX",
49+
"url": "https://go.dev/cl/686515"
50+
},
51+
{
52+
"type": "REPORT",
53+
"url": "https://go.dev/issue/74380"
54+
},
55+
{
56+
"type": "WEB",
57+
"url": "https://groups.google.com/g/golang-announce/c/gTNJnDXmn34"
58+
}
59+
],
60+
"credits": [
61+
{
62+
"name": "RyotaK (https://ryotak.net) of GMO Flatt Security Inc"
63+
}
64+
],
65+
"database_specific": {
66+
"url": "https://pkg.go.dev/vuln/GO-2025-3828",
67+
"review_status": "REVIEWED"
68+
}
69+
}

‎data/reports/GO-2025-3828.yaml‎

Lines changed: 34 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,34 @@
1+
id: GO-2025-3828
2+
modules:
3+
- module: cmd
4+
versions:
5+
- fixed: 1.23.11
6+
- introduced: 1.24.0-0
7+
- fixed: 1.24.5
8+
vulnerable_at: 1.24.4
9+
packages:
10+
- package: cmd/go
11+
summary: Unexpected command execution in untrusted VCS repositories in cmd/go
12+
description: |-
13+
The go command may execute unexpected commands when operating in untrusted VCS
14+
repositories.
15+
16+
This occurs when possibly dangerous VCS configuration is present in
17+
repositories. This can happen when a repository was fetched via one VCS (e.g.
18+
Git), but contains metadata for another VCS (e.g. Mercurial). Modules which are
19+
retrieved using the go command line, i.e. via "go get", are not affected.
20+
cves:
21+
- CVE-2025-4674
22+
credits:
23+
- RyotaK (https://ryotak.net) of GMO Flatt Security Inc
24+
references:
25+
- fix: https://go.dev/cl/686515
26+
- report: https://go.dev/issue/74380
27+
- web: https://groups.google.com/g/golang-announce/c/gTNJnDXmn34
28+
cve_metadata:
29+
id: CVE-2025-4674
30+
cwe: 'CWE-73: External Control of File Name or Path'
31+
source:
32+
id: go-security-team
33+
created: 2025-07-29T12:57:41.158468-07:00
34+
review_status: REVIEWED

0 commit comments

Comments
 (0)