CVE-2025-4674

HighCVSS 8.6/10Last modified Jun 17, 2026

Description

The go command may execute unexpected commands when operating in untrusted VCS repositories. This occurs when possibly dangerous VCS configuration is present in repositories. This can happen when a repository was fetched via one VCS (e.g. Git), but contains metadata for another VCS (e.g. Mercurial). Modules which are retrieved using the go command line, i.e. via "go get", are not affected.

Metrics

CVSS 3.1 8.6/10CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

Weakness enumeration

CWE-73

Affected software

No affected versions have been published.

Timeline

Published
Jul 29, 2025
Last modified
Jun 17, 2026
NVD status
Analyzed

Related CVEs from 2025

CVE-2025-467407.5An authenticated user without user administrative permissions could change the administrator Account Name.CVE-2025-467415.7A suspended or recently logged-out user could continue to interact with Blueframe until the time-out period occurred.CVE-2025-467424.3Users who were required to change their password could still access system information before changing their passwordCVE-2025-467436.3An authenticated user's token could be used by another source after the user had logged out prior to the token expiring.CVE-2025-467442.7An authenticated administrator could modify the Created By username for a user accountCVE-2025-467456.5An authenticated user without user-management permissions could view other users account information.CVE-2025-467465.8An administrator could discover another account's credentials.CVE-2025-467475.7An authenticated user without user-management permissions could identify other user accounts.CVE-2025-467482.7An authenticated user attempting to change their password could do so without using the current password.CVE-2025-467494.3An authenticated user could submit scripting to fields that lack proper input and output sanitization leading to subsequent client-side scriCVE-2025-46756.5Improper Check for Unusual or Exceptional Conditions vulnerability in ABB WebPro SNMP Card PowerValue, ABB WebPro SNMP Card PowerValue UL.ThCVE-2025-467504.4SEL BIOS packages prior to 1.3.49152.117 or 2.6.49152.98 allow a local attacker to bypass password authentication and change password-protec