BaseFortify

Publication date: 2026-01-28

Last updated on: 2026-06-30

Assigner: Go Project

Description

Building a malicious file with cmd/go can cause can cause a write to an attacker-controlled file with partial control of the file content. The "#cgo pkg-config:" directive in a Go source file provides command-line arguments to provide to the Go pkg-config command. An attacker can provide a "--log-file" argument to this directive, causing pkg-config to write to an attacker-controlled location.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-01-28

Last Modified

2026-06-30

Generated

2026-07-06

AI Q&A

2026-01-29

EPSS Evaluated

2026-07-05

NVD

CVE-2025-61731

EUVD

EUVD-2025-206447

Affected Vendors & Products

Vendor	Product	Version / Range
golang	go	to 1.24.12 (exc)
golang	go	From 1.25.0 (inc) to 1.25.6 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-88	The product constructs a string for a command to be executed by a separate component in another control sphere, but it does not properly delimit the intended arguments, options, or switches within that command string.

Attack-Flow Graph

Executive Summary

This vulnerability occurs when a malicious file built with cmd/go uses the "#cgo pkg-config:" directive in a Go source file to pass command-line arguments to the Go pkg-config command. An attacker can supply a "--log-file" argument through this directive, causing pkg-config to write to a file at an attacker-controlled location with partial control over the file content.

Impact Analysis

The vulnerability can allow an attacker to write to files at locations they control, potentially leading to unauthorized file modification or creation. This could be exploited to overwrite important files or inject malicious content, impacting system integrity or security.

Hi! I’m here to help you understand CVE-2025-61731. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70