CVE-2025-68120: 
Go vulnerability analysis and mitigation

CVE-2025-68120 is a code injection vulnerability in the Visual Studio Code Go extension (github.com/golang/vscode-go) that allows unexpected untrusted code execution. All versions prior to 0.52.1 are affected. The vulnerability was disclosed on December 29–30, 2025, with a patch released in version 0.52.1. It carries a CVSS v3.1 base score of 5.4 (Medium), as assessed by CISA-ADP (GitHub Advisory, Red Hat).

The root cause is classified as CWE-94 (Improper Control of Generation of Code / Code Injection), where the VS Code Go extension fails to properly restrict code execution when operating in VS Code's Restricted Mode — a sandboxed environment intended to prevent untrusted workspace code from running (GitHub Advisory). An attacker with low-level network access and authenticated (low-privilege) access can trigger untrusted code execution without requiring user interaction. The fix disables the extension entirely when VS Code is operating in Restricted Mode, preventing the vulnerable execution path (Go Vuln DB, Golang Dev Mailing List).

Successful exploitation results in low-level confidentiality impact (partial data exposure) and availability degradation on the affected system, with no integrity impact. The attack requires low privileges and no user interaction, making it relatively straightforward to attempt against systems where the vulnerable extension is installed and network-accessible. Lateral movement potential is limited given the constrained impact scope, but unauthorized code execution in a developer environment could expose source code, credentials, or build artifacts (GitHub Advisory, Red Hat).

There is no public proof-of-concept exploit and no evidence of active in-the-wild exploitation as of the time of disclosure (Red Hat). The EPSS score is approximately 0.022–0.024%, placing it in the 7th percentile for exploitation likelihood within 30 days (GitHub Advisory). The CVE is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. A GitHub repository (choewonwoo1817/CVE-2025-68120) referencing this CVE was noted in tracking data, though no weaponized exploit code has been confirmed.

Update the Visual Studio Code Go extension (github.com/golang/vscode-go) to version 0.52.1 or later, which disables the extension in Restricted Mode to prevent untrusted code execution (GitHub Advisory, Go Vuln DB). As an interim workaround, enable VS Code's Restricted Mode for untrusted workspaces to limit the extension's ability to execute code. Administrators should audit developer environments running affected versions and review any recent unexpected code execution events.

The vulnerability received routine coverage across vulnerability tracking platforms and security community feeds, including mentions on Mastodon (infosec.exchange) and Bluesky shortly after disclosure (Feedly). Red Hat acknowledged the CVE and published a tracking entry (Red Hat). SUSE also issued a govulncheck advisory referencing this CVE. Overall community sentiment reflects low urgency given the moderate severity, absence of a public PoC, and availability of a straightforward patch.