The go command may execute unexpected commands when operating in untrusted VCS repositories. This occurs when possibly dangerous VCS configuration is present in repositories. This can happen when a repository was fetched via one VCS (e.g. Git), but contains metadata for another VCS (e.g. Mercurial). Modules which are retrieved using the go command line, i.e. via "go get", are not affected.
CVSS Details
- CVSS 3.1 Base Score: 8.6
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade golang-raceUpgrade delveUpgrade golang-docsUpgrade golang-miscUpgrade golang-srcUpgrade go-toolsetUpgrade golang-binUpgrade golangUpgrade golang-tests | Aug 19, 2025 | Aug 18, 2025 |
| Alpine Linux | — | Upgrade go | Aug 14, 2025 | Jul 29, 2025 |
| Amazon Linux Ami 2 | — | Upgrade golang-miscUpgrade golang-srcUpgrade golangUpgrade golang-testsUpgrade golang-sharedUpgrade golang-docsUpgrade golang-bin | May 20, 2026 | May 20, 2026 |
| Amazon_linux_2023 | — | Upgrade golangUpgrade golang-srcUpgrade golang-miscUpgrade golang-sharedUpgrade golang-binUpgrade golang-docsUpgrade golang-tests | Aug 1, 2025 | Jul 29, 2025 |
| Debian | — | No solution exists | Jul 10, 2025 | Jul 10, 2025 |
| Huawei Euleros 2_0_sp13 | — | Upgrade golang-develUpgrade golang-helpUpgrade golang | Dec 12, 2025 | Dec 11, 2025 |
| Oracle_linux | — | Upgrade golang-docsUpgrade go-toolsetUpgrade delveUpgrade golang-srcUpgrade golangUpgrade golang-binUpgrade golang-raceUpgrade golang-testsUpgrade golang-misc | Aug 19, 2025 | Jul 29, 2025 |
| Redhat_linux | — | Upgrade golang-binUpgrade golang-miscUpgrade go-toolsetUpgrade golangUpgrade golang-testsUpgrade golang-docsUpgrade golang-raceUpgrade delve-debugsourceUpgrade golang-srcUpgrade delve-debuginfoUpgrade delve | Jul 31, 2025 | Jul 29, 2025 |
| Rocky_linux | — | Upgrade golang-raceUpgrade golang-binUpgrade delve-debugsourceUpgrade delveUpgrade delve-debuginfoUpgrade golangUpgrade go-toolset | Feb 5, 2026 | Sep 8, 2025 |
| Suse | — | Upgrade go1.25-openssl-docUpgrade go1.24Upgrade go1.24-raceUpgrade go1.24-openssl-docUpgrade go1.25-raceUpgrade go1.25Upgrade go1.23Upgrade go1.23-docUpgrade go1.24-docUpgrade go1.25-libstdUpgrade go1.23-openssl-raceUpgrade go1.25-opensslUpgrade go1.23-opensslUpgrade go1.25-docUpgrade go1.23-raceUpgrade go1.25-openssl-raceUpgrade govulncheck-vulndbUpgrade go1.24-libstdUpgrade go1.23-openssl-docUpgrade go1.24-opensslUpgrade go1.24-openssl-race | Jul 14, 2025 | Jul 11, 2025 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jun 15, 2026 | Jul 29, 2025 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub