CVE-2025-68119: Golang Go RCE Vulnerability

CVE-2025-68119 Overview

CVE-2025-68119 affects the Go toolchain when it downloads and builds modules with attacker-controlled version strings. On systems with Mercurial (hg) installed, fetching modules from non-standard sources can trigger unexpected code execution through improperly constructed external version control system (VCS) commands. On systems with Git installed, the same class of flaw allows arbitrary file writes on the filesystem. The issue is triggered only when a developer explicitly supplies the malicious version string to the toolchain. Retrieving modules via @latest or bare module paths is not affected.

Critical Impact
An attacker who supplies a crafted module version string to a Go build can execute local code or write arbitrary files on the developer or build system.

Affected Products

Golang Go toolchain (see Go Vulnerability Report GO-2026-4338 for fixed versions)
Systems with Mercurial (hg) installed that fetch Go modules from custom domains
Systems with Git installed that build Go modules using attacker-supplied version strings

Discovery Timeline

2026-01-28 - CVE-2025-68119 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-68119

Vulnerability Analysis

The Go toolchain resolves module dependencies by invoking external VCS binaries such as git and hg. When a module lives on a non-standard source, the toolchain constructs command arguments that include portions of the module path and version string. Insufficient validation of those inputs lets an attacker influence how the external command is assembled, resulting in local code execution when Mercurial is present and arbitrary file writes when Git is present. The flaw is classified under CWE-787 (Out-of-bounds Write) in the NVD entry, reflecting the file-write behavior on the Git path.

Root Cause

The root cause is unsafe construction of VCS command invocations from untrusted module version strings and module paths. The toolchain does not sufficiently sanitize these strings before passing them to hg or git, allowing an attacker to smuggle options or targets that either trigger Mercurial extension-loading behavior or cause Git to write to attacker-chosen filesystem paths.

Attack Vector

Exploitation requires an attacker to convince a developer, CI job, or build system to fetch and build a module with a malicious version string, for example through go get module@<malicious-version> or through a go.mod requirement referencing a custom source. The attack does not work against @latest or bare module paths. Exploitation therefore targets local build environments, but the impact escalates rapidly in shared build infrastructure and multi-tenant CI pipelines.

Because no verified proof-of-concept is published, refer to the Go issue tracker post and the Go change list 736710 for the authoritative technical description and fix.

Detection Methods for CVE-2025-68119

Indicators of Compromise

Unexpected child processes of go, go build, or go mod download that invoke hg, git, or shell interpreters with unusual arguments.
New or modified files outside the module cache (for example under $HOME, /etc, or CI workspace roots) following a module fetch.
Presence of Mercurial extension files or .hg/hgrc entries written during a Go build.
Module version strings in go.mod, go.sum, or CI logs that contain suspicious characters, path separators, or option-like tokens.

Detection Strategies

Monitor build hosts for go processes spawning hg or git with arguments that reference filesystem paths outside the module cache.
Alert on writes to sensitive locations (SSH keys, shell rc files, cron directories) during Go module resolution.
Inspect dependency changes in code review for module version strings with atypical formatting or non-standard VCS sources.

Monitoring Recommendations

Enable process and file-system telemetry on developer workstations and CI runners that execute go build or go get.
Centralize Go build logs and search for VCS command lines containing shell metacharacters or unexpected flags.
Track installed Go toolchain versions across the fleet and alert when unpatched versions fetch external modules.

How to Mitigate CVE-2025-68119

Immediate Actions Required

Upgrade the Go toolchain to a fixed release as listed in GO-2026-4338 on all developer and CI systems.
Audit go.mod files and CI pipelines for pinned versions that reference non-standard module sources or unusual version strings.
Restrict use of hg-backed modules on systems where Mercurial is installed until the toolchain is patched.

Patch Information

The fix is tracked in the Go change list 736710 and referenced by the Go issue 77099. Coordinated details are published in the golang-announce update. Apply the corresponding Go toolchain release on every host that runs go build, go get, or go mod commands, including container images used by CI.

Workarounds

Avoid passing explicit, untrusted module version strings to the toolchain; prefer @latest or bare module paths until patched.
Remove Mercurial (hg) from build systems that do not require it to eliminate the code-execution path.
Run Go builds inside isolated, ephemeral containers with least-privilege filesystem access to limit arbitrary file-write impact.
Enforce module proxy usage (GOPROXY) with an allowlist of trusted sources and set GOVCS to restrict which VCS tools may be invoked.

bash

# Configuration example: restrict VCS usage and force a trusted module proxy
export GOPROXY="https://proxy.golang.org,direct"
export GOSUMDB="sum.golang.org"
export GOVCS="*:git"    # disallow hg, bzr, svn for module resolution
export GOFLAGS="-mod=readonly"