CVE-2025-4674: Go Command RCE Vulnerability in VCS

CVE-2025-4674 Overview

CVE-2025-4674 is a command injection vulnerability affecting the Go programming language toolchain. The go command may execute unexpected commands when operating in untrusted version control system (VCS) repositories. This occurs when potentially dangerous VCS configuration is present in repositories, specifically when a repository was fetched via one VCS (e.g., Git) but contains metadata for another VCS (e.g., Mercurial). Importantly, modules retrieved using the go command line via go get are not affected by this vulnerability.

Critical Impact

Attackers can craft malicious repositories that execute arbitrary commands when developers work with them locally, potentially leading to complete system compromise with high confidentiality, integrity, and availability impact.

Affected Products

• Go programming language toolchain (versions prior to security patch)
• Development environments using the go command with local VCS repositories
• Build systems that operate on untrusted VCS repositories

Discovery Timeline

• 2025-07-29 - CVE CVE-2025-4674 published to NVD
• 2025-11-04 - Last updated in NVD database

Technical Details for CVE-2025-4674

Vulnerability Analysis

This vulnerability is classified under CWE-73 (External Control of File Name or Path), which relates to the improper handling of externally controlled input that affects file system operations. The vulnerability stems from the Go toolchain's handling of VCS metadata within repositories.

When a developer works with a local repository, the Go command processes VCS configuration files to determine how to interact with the repository. The vulnerability arises when a repository contains conflicting VCS metadata—for example, a Git repository that also contains Mercurial configuration files (.hg directory or .hgrc files). The Go toolchain may inadvertently process the secondary VCS configuration, which can contain malicious commands or hooks that execute during repository operations.

The local attack vector requires user interaction, meaning an attacker must convince a developer to clone or work with a malicious repository. However, once this occurs, the impact is severe with the ability to achieve code execution in the context of the developer's user session.

Root Cause

The root cause is improper validation and handling of VCS metadata when multiple VCS systems have configuration present in the same repository. The Go command does not properly isolate or validate VCS configuration files, allowing attacker-controlled configuration from an unexpected VCS system to influence command execution. This represents an external control vulnerability where file paths and configuration options can be manipulated to execute arbitrary commands.

Attack Vector

The attack requires local access and user interaction. An attacker crafts a repository that appears legitimate but contains hidden malicious VCS configuration for a secondary version control system. The attack sequence typically involves:

1. An attacker creates a Git repository with a seemingly legitimate Go module
2. The attacker embeds malicious Mercurial (or other VCS) configuration files within the repository
3. A developer clones the repository and runs Go commands within it
4. The Go toolchain processes the malicious VCS configuration, executing attacker-controlled commands

The vulnerability specifically affects operations on local repositories and does not impact modules retrieved via go get from remote sources, as those go through a different code path with proper sanitization.

Detection Methods for CVE-2025-4674

Indicators of Compromise

• Presence of unexpected VCS configuration directories (e.g., .hg, .svn, .bzr) in Git repositories
• Unusual process spawning from Go toolchain commands during build operations
• Execution of VCS binaries (mercurial, svn, bzr) in contexts where only Git operations are expected
• Suspicious entries in VCS configuration files containing shell commands or external script references

Detection Strategies

• Implement file integrity monitoring to detect the addition of unexpected VCS metadata directories in repositories
• Monitor process creation events for unusual child processes spawned by Go toolchain executables
• Use static analysis tools to scan repositories for the presence of multiple VCS configuration systems
• Implement repository scanning in CI/CD pipelines to detect conflicting VCS metadata before builds execute

Monitoring Recommendations

• Enable verbose logging for Go toolchain operations in development and build environments
• Configure endpoint detection to alert on VCS binary execution in unexpected contexts
• Implement repository hygiene checks that flag multi-VCS metadata scenarios
• Monitor developer workstations for unusual command execution patterns during Go build operations

How to Mitigate CVE-2025-4674

Immediate Actions Required

• Update the Go toolchain to the latest patched version as indicated in the Go.dev Change Log Entry
• Review any locally cloned repositories for unexpected VCS configuration directories
• Audit build systems and development environments for untrusted repository sources
• Implement repository scanning to detect repositories containing multiple VCS system metadata

Patch Information

The Go development team has released a security patch addressing this vulnerability. Details are available through the official Go.dev Vulnerability Report. The fix ensures proper isolation and validation of VCS configuration when the Go command operates on repositories, preventing the execution of commands from conflicting VCS metadata. Administrators should review the Golang Announcement on Google Groups and the Go.dev Issue Tracker Post for additional context and upgrade guidance.

Workarounds

• Avoid working with repositories from untrusted sources until the patch is applied
• Manually inspect cloned repositories for unexpected VCS configuration directories before running Go commands
• Remove any unexpected VCS metadata directories (.hg, .svn, .bzr) from repositories before use
• Use containerized or sandboxed build environments to limit the impact of potential exploitation
• Implement pre-commit hooks that validate repository contents do not contain conflicting VCS metadata

# Check for unexpected VCS metadata in a repository
find . -type d \( -name ".hg" -o -name ".svn" -o -name ".bzr" \) -print

# Remove unexpected Mercurial metadata if found in a Git repository
rm -rf .hg .hgrc

# Verify only expected VCS configuration exists
ls -la | grep -E "^\.(git|hg|svn|bzr)"