CVE-2025-68119
BaseFortify
Publication date: 2026-01-28
Last updated on: 2026-02-06
Assigner: Go Project
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| golang | go | to 1.24.12 (exc) |
| golang | go | From 1.25.0 (inc) to 1.25.6 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-787 | The product writes data past the end, or before the beginning, of the intended buffer. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability occurs when downloading and building modules with malicious version strings. On systems with Mercurial (hg) installed, downloading modules from non-standard sources can cause unexpected local code execution due to how external version control system commands are constructed. On systems with Git installed, malicious version strings can allow an attacker to write to arbitrary files on the filesystem. This issue requires explicitly providing the malicious version strings to the toolchain and does not affect normal usage with @latest or bare module paths.
How can this vulnerability impact me? :
The vulnerability can lead to local code execution on systems with Mercurial installed, potentially allowing an attacker to run arbitrary code. On systems with Git installed, it can allow an attacker to write to arbitrary files on the filesystem. Both impacts can compromise system integrity and security if malicious version strings are used.
What immediate steps should I take to mitigate this vulnerability?
To mitigate this vulnerability, avoid downloading and building modules from non-standard sources or with explicitly provided malicious version strings. Ensure that modules are fetched using trusted sources and avoid using custom domains for module downloads. Additionally, refrain from providing explicit version strings that could be malicious to the toolchain. Keeping Mercurial and Git usage limited to trusted repositories can reduce risk.