CVE-2025-61731: 
Go vulnerability analysis and mitigation

CVE-2025-61731 is an arbitrary file write vulnerability in the Go programming language's cmd/go tool, specifically affecting the handling of the #cgo pkg-config: directive. By crafting a malicious Go source file that passes a --log-file argument to the directive, an attacker can cause pkg-config to write to an attacker-controlled file path with partial control over the file content. Affected versions include Go before 1.24.12 and Go 1.25.0 through 1.25.5 (before 1.25.6). The vulnerability was published on January 28, 2026, and carries a CVSS v3.1 base score of 7.8 (High) (pkg.go.dev, IBM Advisory).

The root cause is improper neutralization of special elements used in OS command arguments (CWE-78), where the Go build tool fails to sanitize command-line arguments passed via the #cgo pkg-config: directive before forwarding them to the external pkg-config binary. An attacker who can supply a malicious Go source file to a build process can inject --log-file=<path> as an argument, causing pkg-config to write its log output to an arbitrary attacker-specified location on the filesystem. Exploitation requires only local access with low privileges and no user interaction, making it viable in shared build environments or CI/CD pipelines that process untrusted Go source code. The attack vector is local (AV:L), with low attack complexity and no privilege escalation required beyond the initial low-privilege access (pkg.go.dev, go.dev CL).

Successful exploitation allows an attacker with low-privilege local access to write to arbitrary files on the system with partial control over the written content, potentially leading to compromise of confidentiality, integrity, and availability. An attacker could overwrite sensitive configuration files, inject content into scripts or cron jobs, or corrupt critical system files to escalate privileges or establish persistence. In CI/CD or shared build environments where untrusted Go code is compiled, the blast radius extends to any file writable by the build process user (pkg.go.dev, IBM Advisory).

As of the time of reporting, there is no public proof-of-concept exploit and no evidence of active in-the-wild exploitation (pkg.go.dev). The EPSS score is approximately 0.011% (0.000110), indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. No threat actor attribution has been reported.

1. Craft a malicious Go source file: Create a .go file containing a #cgo pkg-config: directive with an injected --log-file argument pointing to a target path, e.g., // #cgo pkg-config: --log-file=/tmp/attacker-controlled-file somepkg.
2. Introduce the file into a build process: Place the malicious source file into a Go project or package that will be compiled by a victim's go build or go install command on a vulnerable Go version (< 1.24.12 or 1.25.0–1.25.5).
3. Trigger the build: When the target system runs go build against the project, cmd/go invokes pkg-config with the unsanitized arguments, including --log-file=<attacker-path>.
4. Achieve file write: pkg-config writes its log output to the attacker-specified path, creating or overwriting the target file with partial attacker-controlled content. The attacker can leverage this to overwrite scripts, configuration files, or other writable assets to escalate privileges or establish persistence (pkg.go.dev, go.dev CL).

• File System: Unexpected or newly created files in sensitive directories (e.g., /etc/, /tmp/, home directories, cron directories) with content resembling pkg-config log output; modification timestamps on configuration or script files coinciding with Go build activity.
• Process: pkg-config process spawned by go build or go install with unusual --log-file arguments pointing to non-standard paths; observable via process auditing tools (e.g., auditd, sysdig).
• Logs: Build system logs showing pkg-config invocations with --log-file arguments; audit logs recording file creation or modification events by the build process user in unexpected locations.
• Network: In CI/CD environments, unexpected outbound connections or file exfiltration following a Go build step may indicate post-exploitation activity leveraging the written file.

Update Go to version 1.24.12 or later (for the 1.24.x branch) or 1.25.6 or later (for the 1.25.x branch), which contain the fix that sanitizes arguments passed to pkg-config via the #cgo pkg-config: directive (go.dev CL, pkg.go.dev). As a workaround, restrict build pipelines to only process trusted Go source files and avoid building untrusted or third-party code with vulnerable Go versions. Additionally, implement filesystem access controls (e.g., using Linux namespaces, containers, or restricted user accounts) to limit the directories writable by the build process, reducing the impact of any successful exploitation. IBM Financial Transaction Manager users should apply the vendor-specific patch referenced in the IBM advisory (IBM Advisory).

The Go security team disclosed the vulnerability via the golang-announce mailing list and published a fix in Go 1.24.12 and 1.25.6 (golang-announce). Security news outlets including CyberSecurityNews and GBHackers covered the release of Go 1.25.6 and 1.24.12 as patching critical vulnerabilities including this one. The vulnerability was also discussed on Reddit's CVEWatch community as a trending CVE. Multiple Linux distributions (SUSE, openSUSE, Red Hat, AlmaLinux, Rocky Linux, Amazon Linux, Mageia) issued security advisories and updated packages in response. No significant controversy or researcher debate has been noted beyond standard patch-and-update guidance.