CVE-2025-68119: 
Go vulnerability analysis and mitigation

CVE-2025-68119 is a vulnerability in the Go toolchain's cmd/go module that allows local code execution and arbitrary file writes when downloading or building modules with malicious version strings. On systems with Mercurial (hg) installed, downloading modules from non-standard sources can trigger unexpected code execution due to improper construction of external VCS commands. On systems with Git installed, malicious version strings can allow an attacker to write to arbitrary files on the filesystem. Affected versions include all Go releases before 1.24.12 and Go 1.25.0 through 1.25.5. It carries a CVSS v3.1 base score of 7.0 (High) (pkg.go.dev, go.dev issue).

The root cause is classified as CWE-787 (Out-of-bounds Write), with an additional OS command injection dimension (CWE-78) related to how external VCS commands (Mercurial, Git) are constructed when resolving module version strings. When a user explicitly provides a crafted version string to the Go toolchain (e.g., via go get module@<malicious-version>), the toolchain fails to properly sanitize the version string before passing it to the underlying VCS binary, enabling command injection (Mercurial path) or arbitrary file writes (Git path). The Mercurial vector can also be triggered by downloading modules from custom/non-standard domains. Importantly, the vulnerability does not affect usage of @latest or bare module paths — only explicitly supplied version strings are at risk (pkg.go.dev, go.dev CL).

Successful exploitation allows a low-privileged attacker to achieve local code execution (on systems with Mercurial installed) or write to arbitrary files on the filesystem (on systems with Git installed), both with the privileges of the user running the Go toolchain. This results in high confidentiality, integrity, and availability impact, potentially enabling privilege escalation, persistence via file overwrites, or supply chain compromise in CI/CD environments that build Go modules from external sources. The scope is limited to the local system, but the impact on developer workstations and build pipelines can be significant (pkg.go.dev).

No public proof-of-concept exploit code is known to exist, and there is no evidence of in-the-wild exploitation at this time (pkg.go.dev). The EPSS score is approximately 0.012% (0.000120), indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires the attacker to control the version string passed to the Go toolchain, which limits the attack surface primarily to scenarios where untrusted version strings are accepted from external input (e.g., automated build systems or developer environments processing third-party module references).

1. Identify a target environment: Locate a system running a vulnerable Go version (before 1.24.12 or 1.25.0–1.25.5) with either Mercurial (hg) or Git installed, where the Go toolchain processes module version strings from external or user-controlled input.
2. Craft a malicious version string: Construct a version string that embeds shell metacharacters or path traversal sequences designed to inject commands into the VCS invocation (Mercurial path) or write to an attacker-controlled file path (Git path).
3. Trigger module download/build: Cause the victim's Go toolchain to execute go get or go build with the malicious version string, e.g., go get example.com/module@<malicious-version>, either by social engineering, supply chain manipulation, or controlling build configuration files.
4. Achieve code execution or file write: On Mercurial-enabled systems, the injected command executes with the privileges of the Go toolchain user. On Git-enabled systems, the attacker writes arbitrary content to a chosen filesystem path, potentially overwriting sensitive files or planting malicious scripts (pkg.go.dev, go.dev issue).

• Process: Unexpected child processes spawned by the Go toolchain (e.g., hg, git) with unusual arguments containing shell metacharacters or path traversal sequences.
• File System: Unexpected or modified files in locations outside the Go module cache (e.g., ~/.config, /etc, or other sensitive directories) with timestamps correlating to Go build activity; new or modified scripts in the Go module cache directory.
• Logs: Shell or system audit logs showing hg or git invocations with anomalous version string arguments; Go build logs referencing non-standard module sources or unusual version strings.
• Network: Outbound connections from the build system to unexpected or custom module proxy domains not matching the organization's approved module sources (pkg.go.dev).

Upgrade Go to version 1.24.12 or later (for the 1.24.x branch) or 1.25.6 or later (for the 1.25.x branch); patches were released on February 6, 2026 (go.dev CL, pkg.go.dev). As a workaround, avoid explicitly providing version strings from untrusted or external sources to the Go toolchain, and restrict module downloads to trusted, standard module paths and proxies. Organizations using CI/CD pipelines should audit build configurations to ensure no user-controlled input reaches go get or go build version arguments. Removing Mercurial from build environments where it is not required also reduces the attack surface for the code execution vector.

The Go team disclosed the vulnerability via the golang-announce mailing list and the official Go issue tracker (golang-announce). Security news outlets including CyberSecurityNews and GBHackers covered the Go 1.25.6/1.24.12 patch releases, noting the vulnerabilities addressed include DoS, memory exhaustion, and this code execution issue. The vulnerability was also discussed on Reddit's CVEWatch community and tracked by multiple Linux distribution security teams (SUSE, openSUSE, Mageia, Amazon Linux) who issued their own advisories. Veeam and Splunk also published advisories acknowledging the impact on their products that bundle the Go toolchain (Veeam KB, Splunk Advisory).