CVE-2025-68120: Visual Studio Code Go Extension RCE Flaw

CVE-2025-68120 Overview

CVE-2025-68120 affects the Go extension for Visual Studio Code. The extension could execute untrusted code when opening workspaces in Restricted Mode. To address this, the Go extension is now disabled in Restricted Mode. This behavior prevents the automatic invocation of Go tooling against files from untrusted sources.

The issue is tracked upstream as GO-2025-4249 and requires an attacker to entice a developer into opening a malicious repository or workspace in VS Code. Exploitation requires local user interaction with a low-privilege context, limiting mass exploitation potential.

Critical Impact
A developer opening a malicious Go workspace in Visual Studio Code could trigger unintended execution of attacker-controlled code paths within the editor context.

Affected Products

Visual Studio Code Go extension (go:go component)
Go tooling integrated with VS Code Restricted Mode workflows
Developer workstations running the Go extension prior to the fixed release

Discovery Timeline

2025-12-30 - CVE-2025-68120 published to the National Vulnerability Database (NVD)
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-68120

Vulnerability Analysis

Visual Studio Code implements Workspace Trust and Restricted Mode to limit the capabilities of extensions when a user opens a workspace from an unverified source. Restricted Mode is designed to prevent automatic task execution, debugger launches, and other side effects that could run attacker-controlled logic.

The Go extension previously remained active in Restricted Mode. Because the Go extension invokes external tooling such as gopls, go build, and formatters during normal editor operations, an untrusted workspace could steer these invocations toward attacker-supplied binaries or configuration. This produced an execution surface that Restricted Mode was intended to eliminate.

The fix disables the Go extension entirely in Restricted Mode. Developers must explicitly mark a workspace as trusted before Go tooling activates.

Root Cause

The root cause is an improper access control gap between the Go extension's activation events and VS Code Workspace Trust boundaries. The extension did not honor Restricted Mode restrictions, allowing workspace-scoped configuration to influence tool invocation before trust was granted. This falls under insecure default configuration and missing authorization for a trusted execution context.

Attack Vector

An attacker publishes a Go repository containing a malicious configuration or auxiliary tooling on disk. A developer clones or opens the repository in Visual Studio Code. Even with Restricted Mode enabled, activation of the Go extension could reference attacker-controlled paths or tools, resulting in unintended code execution within the developer's user context. The attack requires user interaction and low local privileges. See the Go.dev Vulnerability GO-2025-4249 advisory for the authoritative technical description.

Detection Methods for CVE-2025-68120

Indicators of Compromise

Unexpected child processes spawned from Code.exe, code, or code-insiders invoking go, gopls, dlv, or shell interpreters shortly after opening a workspace.
Modifications to .vscode/settings.json, .vscode/tasks.json, or workspace-scoped go.alternateTools entries pointing to non-standard binaries.
Outbound network connections from Go tooling processes to unfamiliar hosts immediately after cloning a repository.

Detection Strategies

Inventory installed VS Code extensions across developer endpoints and identify hosts running vulnerable versions of the Go extension.
Baseline process ancestry for VS Code and alert on Go tooling execution when Workspace Trust telemetry indicates a Restricted Mode session.
Correlate repository clone events with subsequent extension activation and external tool invocation.

Monitoring Recommendations

Enable command-line auditing on developer workstations to capture arguments passed to go, gopls, and related binaries.
Forward VS Code and OS process telemetry to a central data lake for retrospective hunting against known malicious repositories.
Track modifications to user-scoped and workspace-scoped VS Code configuration files under version control review.

How to Mitigate CVE-2025-68120

Immediate Actions Required

Update the Visual Studio Code Go extension to the fixed version referenced in Go.dev Vulnerability GO-2025-4249.
Enforce Workspace Trust across the developer fleet using VS Code enterprise policy.
Instruct developers to review .vscode/ directories before trusting any newly cloned repository.

Patch Information

The fix disables the Go extension in Restricted Mode. Users should upgrade to the patched extension release listed in the vendor advisory. Refer to the Google Group Discussion for the upstream announcement and the NIST CVE-2025-68120 Entry for reference metadata.

Workarounds

Keep untrusted repositories in Restricted Mode and never grant Workspace Trust to unverified sources.
Disable the Go extension manually until the patched version is deployed on developer machines.
Open unknown Go projects inside a container or ephemeral virtual machine to isolate potential code execution.

bash

# Configuration example: enforce Workspace Trust and pin extension version
# settings.json (user scope)
{
  "security.workspace.trust.enabled": true,
  "security.workspace.trust.startupPrompt": "always",
  "security.workspace.trust.untrustedFiles": "prompt",
  "extensions.autoUpdate": true
}