CVE-2025-4674

The go command may execute unexpected commands when operating in untrusted VCS repositories. This occurs when possibly dangerous VCS configuration is present in repositories. This can happen when a repository was fetched via one VCS (e.g. Git), but contains metadata for another VCS (e.g. Mercurial). Modules which are retrieved using the go command line, i.e. via "go get", are not affected.

• CWE-73

• https://go.dev/cl/686515Patch
• https://go.dev/issue/74380Issue Tracking, Third Party Advisory
• https://groups.google.com/g/golang-announce/c/gTNJnDXmn34Mailing List, Release Notes
• https://pkg.go.dev/vuln/GO-2025-3828Vendor Advisory
• http://www.openwall.com/lists/oss-security/2025/07/08/5Mailing List, Release Notes

Published

Jul 29, 2025

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-46734league/commonmark is a PHP Markdown parser. A cross-site scr…6.4
• CVE-2025-46735Terraform WinDNS Provider allows users to manage their Windo…1.1
• CVE-2025-46736Umbraco is a free and open source .NET content management sy…5.3
• CVE-2025-46737SEL-5037 Grid Configurator contains an overly permissive Cro…7.4
• CVE-2025-46738An authenticated attacker can maliciously modify layout data…6.6
• CVE-2025-46739An unauthenticated user could discover account credentials v…8.1
• CVE-2025-46740An authenticated user without user administrative permission…7.5
• CVE-2025-46741A suspended or recently logged-out user could continue to in…5.7
• CVE-2025-46742Users who were required to change their password could still…4.3
• CVE-2025-46743An authenticated user's token could be used by another sourc…6.3
• CVE-2025-46744An authenticated administrator could modify the Created By u…2.7
• CVE-2025-46745An authenticated user without user-management permissions co…6.5