CVE-2025-68119 in cmd-go
Summary
by MITRE • 01/28/2026
Downloading and building modules with malicious version strings can cause local code execution. On systems with Mercurial (hg) installed, downloading modules from non-standard sources (e.g., custom domains) can cause unexpected code execution due to how external VCS commands are constructed. This issue can also be triggered by providing a malicious version string to the toolchain. On systems with Git installed, downloading and building modules with malicious version strings can allow an attacker to write to arbitrary files on the filesystem. This can only be triggered by explicitly providing the malicious version strings to the toolchain and does not affect usage of @latest or bare module paths.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 07/06/2026
This vulnerability represents a critical security flaw in package management systems that process external module dependencies through version control systems. The issue manifests when developers or automated systems download and build modules from non-standard sources, particularly those utilizing mercurial or git as underlying version control mechanisms. The vulnerability stems from improper handling of version strings and external command construction, creating opportunities for arbitrary code execution. When mercurial is present on the system, malicious version strings can trigger unexpected code execution through improper command construction, while git installations face similar risks through file system write operations. The vulnerability specifically targets the toolchain's handling of external module sources, making it particularly dangerous in development environments where automated dependency management is common.
The technical implementation of this vulnerability exploits command injection patterns within version control system integration. In mercurial scenarios, the system constructs external commands using user-provided version strings without adequate sanitization, allowing attackers to inject malicious commands that execute with the privileges of the user running the package manager. This follows the CWE-78 principle of improper neutralization of special elements used in OS commands. When git is involved, the vulnerability allows attackers to manipulate the file system through malicious version strings, enabling arbitrary file writes that can compromise system integrity. The ATT&CK framework categorizes this under T1059.001 for command and scripting interpreter execution and T1078 for valid accounts, as the attacks leverage legitimate system tools to achieve unauthorized execution.
The operational impact of this vulnerability extends beyond simple code execution to potentially compromise entire development environments and production systems. Attackers can leverage this vulnerability to install backdoors, modify critical system files, or escalate privileges through the compromised package management processes. The vulnerability's trigger mechanism requires explicit provision of malicious version strings, which makes it less likely to occur in normal usage patterns but still poses significant risk in automated build environments or when developers trust unverified module sources. Systems with both mercurial and git installed face the highest risk as they provide multiple attack vectors through different version control mechanisms. The vulnerability affects development workflows where custom domains or non-standard module sources are used, potentially compromising the integrity of entire software supply chains.
Mitigation strategies must address both the immediate command injection vulnerabilities and broader supply chain security concerns. Organizations should implement strict validation of version strings and external source URLs before processing them through version control systems. The recommended approach includes sanitizing all user-provided inputs and implementing proper command construction practices that prevent shell injection attacks. Additionally, organizations should consider restricting access to external VCS commands and implementing sandboxed environments for module downloads and builds. Regular security audits of package management configurations and automated dependency resolution processes are essential to identify and remediate similar vulnerabilities. The use of dependency lock files and trusted package registries can help reduce exposure by limiting the attack surface of potentially malicious version strings. Security teams should also monitor for unusual patterns in package downloads and module resolution that might indicate exploitation attempts, as this vulnerability requires explicit user interaction to trigger.