{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "HIGH",
              "attackVector": "LOCAL",
              "availabilityImpact": "HIGH",
              "baseScore": 7,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "LOW",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2025-68119",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-01-29T04:55:55.432053Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-02-26T15:04:45.665Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://pkg.go.dev",
          "defaultStatus": "unaffected",
          "packageName": "cmd/go",
          "product": "cmd/go",
          "vendor": "Go toolchain",
          "versions": [
            {
              "lessThan": "1.25.6",
              "status": "affected",
              "version": "1.25.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "splitline (@splitline) from DEVCORE Research Team"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Downloading and building modules with malicious version strings can cause local code execution. On systems with Mercurial (hg) installed, downloading modules from non-standard sources (e.g., custom domains) can cause unexpected code execution due to how external VCS commands are constructed. This issue can also be triggered by providing a malicious version string to the toolchain. On systems with Git installed, downloading and building modules with malicious version strings can allow an attacker to write to arbitrary files on the filesystem. This can only be triggered by explicitly providing the malicious version strings to the toolchain and does not affect usage of @latest or bare module paths."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "CWE-78: Improper Neutralization of Special Elements used in an OS Command (\u0027OS Command Injection\u0027)",
              "lang": "en"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-01-28T19:30:30.704Z",
        "orgId": "1bb62c36-49e3-4200-9d77-64a1400537cc",
        "shortName": "Go"
      },
      "references": [
        {
          "url": "https://go.dev/cl/736710"
        },
        {
          "url": "https://go.dev/issue/77099"
        },
        {
          "url": "https://groups.google.com/g/golang-announce/c/Vd2tYVM8eUc"
        },
        {
          "url": "https://pkg.go.dev/vuln/GO-2026-4338"
        }
      ],
      "title": "Unexpected code execution when invoking toolchain in cmd/go"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "1bb62c36-49e3-4200-9d77-64a1400537cc",
    "assignerShortName": "Go",
    "cveId": "CVE-2025-68119",
    "datePublished": "2026-01-28T19:30:30.704Z",
    "dateReserved": "2025-12-15T16:48:04.450Z",
    "dateUpdated": "2026-02-26T15:04:45.665Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2025-68119",
      "date": "2026-08-18",
      "epss": "0.00335",
      "percentile": "0.26458"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2025-68119\",\"sourceIdentifier\":\"security@golang.org\",\"published\":\"2026-01-28T20:16:11.443\",\"lastModified\":\"2026-06-17T09:58:33.560\",\"vulnStatus\":\"Analyzed\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"Downloading and building modules with malicious version strings can cause local code execution. On systems with Mercurial (hg) installed, downloading modules from non-standard sources (e.g., custom domains) can cause unexpected code execution due to how external VCS commands are constructed. This issue can also be triggered by providing a malicious version string to the toolchain. On systems with Git installed, downloading and building modules with malicious version strings can allow an attacker to write to arbitrary files on the filesystem. This can only be triggered by explicitly providing the malicious version strings to the toolchain and does not affect usage of @latest or bare module paths.\"},{\"lang\":\"es\",\"value\":\"Descargar y construir m\u00f3dulos con cadenas de versi\u00f3n maliciosas puede causar la ejecuci\u00f3n de c\u00f3digo local. En sistemas con Mercurial (hg) instalado, descargar m\u00f3dulos de fuentes no est\u00e1ndar (por ejemplo, dominios personalizados) puede causar la ejecuci\u00f3n de c\u00f3digo inesperada debido a c\u00f3mo se construyen los comandos VCS externos. Este problema tambi\u00e9n puede ser provocado al proporcionar una cadena de versi\u00f3n maliciosa a la cadena de herramientas. En sistemas con Git instalado, descargar y construir m\u00f3dulos con cadenas de versi\u00f3n maliciosas puede permitir a un atacante escribir en archivos arbitrarios en el sistema de archivos. Esto solo puede ser provocado al proporcionar expl\u00edcitamente las cadenas de versi\u00f3n maliciosas a la cadena de herramientas y no afecta el uso de @latest o rutas de m\u00f3dulo bare.\"}],\"affected\":[{\"source\":\"security@golang.org\",\"affectedData\":[{\"vendor\":\"Go toolchain\",\"product\":\"cmd/go\",\"defaultStatus\":\"unaffected\",\"collectionURL\":\"https://pkg.go.dev\",\"packageName\":\"cmd/go\",\"versions\":[{\"version\":\"1.25.0\",\"lessThan\":\"1.25.6\",\"versionType\":\"semver\",\"status\":\"affected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.0,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"HIGH\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.0,\"impactScore\":5.9}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2026-01-29T04:55:55.432053Z\",\"id\":\"CVE-2025-68119\",\"options\":[{\"exploitation\":\"none\"},{\"automatable\":\"no\"},{\"technicalImpact\":\"total\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-787\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:golang:go:*:*:*:*:*:*:*:*\",\"versionEndExcluding\":\"1.24.12\",\"matchCriteriaId\":\"21FD9368-8AB3-404B-8599-BBF64EFE3C7B\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:golang:go:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"1.25.0\",\"versionEndExcluding\":\"1.25.6\",\"matchCriteriaId\":\"A547E844-78D2-4B17-B7A9-73E7B503D2CE\"}]}]}],\"references\":[{\"url\":\"https://go.dev/cl/736710\",\"source\":\"security@golang.org\",\"tags\":[\"Patch\"]},{\"url\":\"https://go.dev/issue/77099\",\"source\":\"security@golang.org\",\"tags\":[\"Issue Tracking\",\"Patch\"]},{\"url\":\"https://groups.google.com/g/golang-announce/c/Vd2tYVM8eUc\",\"source\":\"security@golang.org\",\"tags\":[\"Mailing List\",\"Release Notes\"]},{\"url\":\"https://pkg.go.dev/vuln/GO-2026-4338\",\"source\":\"security@golang.org\",\"tags\":[\"Vendor Advisory\"]}]}}",
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-06-28T07:09:05+00:00",
      "cve": "CVE-2025-68119",
      "id": "CVE-2025-68119",
      "initial_release_date": "2025-01-01T00:00:00+00:00",
      "product_status:fixed": "8",
      "product_status:known_affected": "27",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "cmd/go: cmd/go: Local code execution and arbitrary file write via malicious module version strings",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-68119.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "important",
      "current_release_date": "2026-08-10T16:40:13Z",
      "cve": "CVE-2025-68119",
      "id": "CVE-2025-68119",
      "initial_release_date": "2026-01-17T00:27:56Z",
      "product_status:known_affected": "24",
      "product_status:known_not_affected": "108",
      "product_status:recommended": "274",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2025-68119",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2025-68119.json",
      "version": "31"
    },
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"cvssV3_1\": {\"scope\": \"UNCHANGED\", \"version\": \"3.1\", \"baseScore\": 7, \"attackVector\": \"LOCAL\", \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H\", \"integrityImpact\": \"HIGH\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"HIGH\", \"availabilityImpact\": \"HIGH\", \"privilegesRequired\": \"LOW\", \"confidentialityImpact\": \"HIGH\"}}, {\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2025-68119\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"total\"}], \"version\": \"2.0.3\", \"timestamp\": \"2026-01-29T04:55:55.432053Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2026-01-29T16:16:35.294Z\"}}], \"cna\": {\"title\": \"Unexpected code execution when invoking toolchain in cmd/go\", \"credits\": [{\"lang\": \"en\", \"value\": \"splitline (@splitline) from DEVCORE Research Team\"}], \"affected\": [{\"vendor\": \"Go toolchain\", \"product\": \"cmd/go\", \"versions\": [{\"status\": \"affected\", \"version\": \"1.25.0\", \"lessThan\": \"1.25.6\", \"versionType\": \"semver\"}], \"packageName\": \"cmd/go\", \"collectionURL\": \"https://pkg.go.dev\", \"defaultStatus\": \"unaffected\"}], \"references\": [{\"url\": \"https://go.dev/cl/736710\"}, {\"url\": \"https://go.dev/issue/77099\"}, {\"url\": \"https://groups.google.com/g/golang-announce/c/Vd2tYVM8eUc\"}, {\"url\": \"https://pkg.go.dev/vuln/GO-2026-4338\"}], \"descriptions\": [{\"lang\": \"en\", \"value\": \"Downloading and building modules with malicious version strings can cause local code execution. On systems with Mercurial (hg) installed, downloading modules from non-standard sources (e.g., custom domains) can cause unexpected code execution due to how external VCS commands are constructed. This issue can also be triggered by providing a malicious version string to the toolchain. On systems with Git installed, downloading and building modules with malicious version strings can allow an attacker to write to arbitrary files on the filesystem. This can only be triggered by explicitly providing the malicious version strings to the toolchain and does not affect usage of @latest or bare module paths.\"}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"description\": \"CWE-78: Improper Neutralization of Special Elements used in an OS Command (\u0027OS Command Injection\u0027)\"}]}], \"providerMetadata\": {\"orgId\": \"1bb62c36-49e3-4200-9d77-64a1400537cc\", \"shortName\": \"Go\", \"dateUpdated\": \"2026-01-28T19:30:30.704Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2025-68119\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-01-29T16:16:38.174Z\", \"dateReserved\": \"2025-12-15T16:48:04.450Z\", \"assignerOrgId\": \"1bb62c36-49e3-4200-9d77-64a1400537cc\", \"datePublished\": \"2026-01-28T19:30:30.704Z\", \"assignerShortName\": \"Go\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}