# CVE-2025-4674: Unexpected command execution in untrusted VCS repositories in cmd/go CVE-2025-4674 is fixed in 16 products on 1 platform, first by SUSE-SU-2025:02295-1, released July 11, 2025. It is not reported as exploited. Patch Radar priority: High. - Web page: https://patchblox.com/security/cve/CVE-2025-4674 - Priority: High - CVSS: 8.6 (Important) - EPSS: 0.0048 - CISA KEV: not listed - Exploited (vendor report): no - Publicly disclosed: no - Published: Jul 11, 2025 - Weakness: External Control of File Name or Path - Vendor advisory: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-4674 ## Description Go Toolset provides the Go programming language tools and libraries. Go is alternatively known as golang. Security Fix(es): * cmd/go: Go VCS Command Execution Vulnerability (CVE-2025-4674) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. ## Where it's fixed | Platform | Product | Fixed in | Fix | Released | |---|---|---|---|---| | Linux | delve RHEL 8 | 0:1.24.1-1.module+el8.10.0+22945+b2c96a17 | [RHSA-2025:13940](https://patchblox.com/security/data/fix/linux/rhsa-2025-13940.md) | Aug 18, 2025 | | Linux | delve almalinux 8 | 1.24.1-1.module_el8.10.0+3977+66935a26 | [ALSA-2025:13940](https://patchblox.com/security/data/fix/linux/alsa-2025-13940.md) | Aug 18, 2025 | | Linux | delve ol 8 | 0:1.24.1-1.0.1.module+el8.10.0+90602+3daf471e | [ELSA-2025-13940](https://patchblox.com/security/data/fix/linux/elsa-2025-13940.md) | Aug 18, 2025 | | Linux | delve rocky 8 | 0:1.24.1-1.module+el8.10.0+1951+c74bd827 | [RLSA-2025:13940](https://patchblox.com/security/data/fix/linux/rlsa-2025-13940.md) | Sep 8, 2025 | | Linux | go-toolset RHEL 8 | 0:1.24.6-1.module+el8.10.0+23407+428597c7 | [RHSA-2025:13940](https://patchblox.com/security/data/fix/linux/rhsa-2025-13940.md) | Aug 18, 2025 | | Linux | go-toolset RHEL 9 | 0:1.24.6-1.el9_6 | [RHSA-2025:13935](https://patchblox.com/security/data/fix/linux/rhsa-2025-13935.md) | Aug 18, 2025 | | Linux | go-toolset almalinux 8 | 1.24.6-1.module_el8.10.0+4033+4bf8b620 | [ALSA-2025:13940](https://patchblox.com/security/data/fix/linux/alsa-2025-13940.md) | Aug 18, 2025 | | Linux | go-toolset almalinux 9 | 1.24.6-1.el9_6 | [ALSA-2025:13935](https://patchblox.com/security/data/fix/linux/alsa-2025-13935.md) | Aug 18, 2025 | | Linux | go-toolset ol 10 | 0:1.24.6-1.el10_0 | [ELSA-2025-13941](https://patchblox.com/security/data/fix/linux/elsa-2025-13941.md) | Aug 18, 2025 | | Linux | go-toolset ol 8 | 0:1.24.6-1.module+el8.10.0+90641+f7c45302 | [ELSA-2025-13940](https://patchblox.com/security/data/fix/linux/elsa-2025-13940.md) | Aug 18, 2025 | | Linux | go-toolset ol 9 | 0:1.24.6-1.el9_6 | [ELSA-2025-13935](https://patchblox.com/security/data/fix/linux/elsa-2025-13935.md) | Aug 17, 2025 | | Linux | go-toolset rocky 8 | 0:1.24.6-1.module+el8.10.0+2048+bc5b2e29 | [RLSA-2025:13940](https://patchblox.com/security/data/fix/linux/rlsa-2025-13940.md) | Sep 8, 2025 | | Linux | go1.23 opensuse-leap 15.6 | 1.23.11-150000.1.37.1 | [SUSE-SU-2025:02296-1](https://patchblox.com/security/data/fix/linux/suse-su-2025-02296-1.md) | Jul 11, 2025 | | Linux | go1.23 sles 15.6 | 1.23.11-150000.1.37.1 | [SUSE-SU-2025:02296-1](https://patchblox.com/security/data/fix/linux/suse-su-2025-02296-1.md) | Jul 11, 2025 | | Linux | go1.23 sles 15.7 | 1.23.11-150000.1.37.1 | [SUSE-SU-2025:02296-1](https://patchblox.com/security/data/fix/linux/suse-su-2025-02296-1.md) | Jul 11, 2025 | | Linux | go1.23-openssl opensuse-leap 15.6 | 1.23.12-150600.13.9.1 | [SUSE-SU-2025:03159-1](https://patchblox.com/security/data/fix/linux/suse-su-2025-03159-1.md) | Sep 11, 2025 | | Linux | go1.23-openssl sles 15.6 | 1.23.12-150600.13.9.1 | [SUSE-SU-2025:03159-1](https://patchblox.com/security/data/fix/linux/suse-su-2025-03159-1.md) | Sep 11, 2025 | | Linux | go1.23-openssl sles 15.7 | 1.23.12-150600.13.9.1 | [SUSE-SU-2025:03159-1](https://patchblox.com/security/data/fix/linux/suse-su-2025-03159-1.md) | Sep 11, 2025 | | Linux | go1.24 opensuse-leap 15.6 | 1.24.5-150000.1.29.1 | [SUSE-SU-2025:02295-1](https://patchblox.com/security/data/fix/linux/suse-su-2025-02295-1.md) | Jul 11, 2025 | | Linux | go1.24 sles 15.6 | 1.24.5-150000.1.29.1 | [SUSE-SU-2025:02295-1](https://patchblox.com/security/data/fix/linux/suse-su-2025-02295-1.md) | Jul 11, 2025 | | Linux | go1.24 sles 15.7 | 1.24.5-150000.1.29.1 | [SUSE-SU-2025:02295-1](https://patchblox.com/security/data/fix/linux/suse-su-2025-02295-1.md) | Jul 11, 2025 | | Linux | go1.24-openssl opensuse-leap 15.6 | 1.24.6-150600.13.9.1 | [SUSE-SU-2025:03158-1](https://patchblox.com/security/data/fix/linux/suse-su-2025-03158-1.md) | Sep 11, 2025 | | Linux | go1.24-openssl sles 15.6 | 1.24.6-150600.13.9.1 | [SUSE-SU-2025:03158-1](https://patchblox.com/security/data/fix/linux/suse-su-2025-03158-1.md) | Sep 11, 2025 | | Linux | go1.24-openssl sles 15.7 | 1.24.6-150600.13.9.1 | [SUSE-SU-2025:03158-1](https://patchblox.com/security/data/fix/linux/suse-su-2025-03158-1.md) | Sep 11, 2025 | | Linux | go1.25 opensuse-leap 15.6 | 1.25.0-150000.1.5.1 | [SUSE-SU-2025:02924-1](https://patchblox.com/security/data/fix/linux/suse-su-2025-02924-1.md) | Aug 20, 2025 | | Linux | go1.25 sles 15.6 | 1.25.0-150000.1.5.1 | [SUSE-SU-2025:02924-1](https://patchblox.com/security/data/fix/linux/suse-su-2025-02924-1.md) | Aug 20, 2025 | | Linux | go1.25 sles 15.7 | 1.25.0-150000.1.5.1 | [SUSE-SU-2025:02924-1](https://patchblox.com/security/data/fix/linux/suse-su-2025-02924-1.md) | Aug 20, 2025 | | Linux | go1.25-openssl opensuse-leap 15.6 | 1.25.6-150600.13.9.1 | [SUSE-SU-2026:0298-1](https://patchblox.com/security/data/fix/linux/suse-su-2026-0298-1.md) | Jan 26, 2026 | | Linux | go1.25-openssl sles 15.6 | 1.25.6-150600.13.9.1 | [SUSE-SU-2026:0298-1](https://patchblox.com/security/data/fix/linux/suse-su-2026-0298-1.md) | Jan 26, 2026 | | Linux | go1.25-openssl sles 15.7 | 1.25.6-150600.13.9.1 | [SUSE-SU-2026:0298-1](https://patchblox.com/security/data/fix/linux/suse-su-2026-0298-1.md) | Jan 26, 2026 | | Linux | golang RHEL 10 | 1.24.6-1.el10_0 | [RHSA-2025:13941](https://patchblox.com/security/data/fix/linux/rhsa-2025-13941.md) | Sep 18, 2025 | | Linux | golang RHEL 8 | 0:1.24.6-1.module+el8.10.0+23407+428597c7 | [RHSA-2025:13940](https://patchblox.com/security/data/fix/linux/rhsa-2025-13940.md) | Aug 18, 2025 | | Linux | golang RHEL 9 | 0:1.24.6-1.el9_6 | [RHSA-2025:13935](https://patchblox.com/security/data/fix/linux/rhsa-2025-13935.md) | Aug 18, 2025 | | Linux | golang almalinux 8 | 1.24.6-1.module_el8.10.0+4033+4bf8b620 | [ALSA-2025:13940](https://patchblox.com/security/data/fix/linux/alsa-2025-13940.md) | Aug 18, 2025 | | Linux | golang almalinux 9 | 1.24.6-1.el9_6 | [ALSA-2025:13935](https://patchblox.com/security/data/fix/linux/alsa-2025-13935.md) | Aug 18, 2025 | | Linux | golang amzn 2023 | 1.24.5-1.amzn2023.0.1 | [ALAS2023-2025-1104](https://patchblox.com/security/data/fix/linux/alas2023-2025-1104.md) | Jul 21, 2025 | | Linux | golang ol 10 | 0:1.24.6-1.el10_0 | [ELSA-2025-13941](https://patchblox.com/security/data/fix/linux/elsa-2025-13941.md) | Aug 18, 2025 | | Linux | golang ol 8 | 0:1.24.6-1.module+el8.10.0+90641+f7c45302 | [ELSA-2025-13940](https://patchblox.com/security/data/fix/linux/elsa-2025-13940.md) | Aug 18, 2025 | | Linux | golang ol 9 | 0:1.24.6-1.el9_6 | [ELSA-2025-13935](https://patchblox.com/security/data/fix/linux/elsa-2025-13935.md) | Aug 17, 2025 | | Linux | golang rocky 10 | 0:1.24.6-1.el10_0 | [RLSA-2025:13941](https://patchblox.com/security/data/fix/linux/rlsa-2025-13941.md) | Oct 3, 2025 | | Linux | golang rocky 8 | 0:1.24.6-1.module+el8.10.0+2048+bc5b2e29 | [RLSA-2025:13940](https://patchblox.com/security/data/fix/linux/rlsa-2025-13940.md) | Sep 8, 2025 | | Linux | golang rocky 9 | 0:1.24.6-1.el9_6 | [RLSA-2025:13935](https://patchblox.com/security/data/fix/linux/rlsa-2025-13935.md) | Oct 4, 2025 | | Linux | golang-bin RHEL 8 | 0:1.24.6-1.module+el8.10.0+23407+428597c7 | [RHSA-2025:13940](https://patchblox.com/security/data/fix/linux/rhsa-2025-13940.md) | Aug 18, 2025 | | Linux | golang-bin RHEL 9 | 0:1.24.6-1.el9_6 | [RHSA-2025:13935](https://patchblox.com/security/data/fix/linux/rhsa-2025-13935.md) | Aug 18, 2025 | | Linux | golang-bin almalinux 8 | 1.24.6-1.module_el8.10.0+4033+4bf8b620 | [ALSA-2025:13940](https://patchblox.com/security/data/fix/linux/alsa-2025-13940.md) | Aug 18, 2025 | | Linux | golang-bin almalinux 9 | 1.24.6-1.el9_6 | [ALSA-2025:13935](https://patchblox.com/security/data/fix/linux/alsa-2025-13935.md) | Aug 18, 2025 | | Linux | golang-bin amzn 2023 | 1.24.5-1.amzn2023.0.1 | [ALAS2023-2025-1104](https://patchblox.com/security/data/fix/linux/alas2023-2025-1104.md) | Jul 21, 2025 | | Linux | golang-bin ol 10 | 0:1.24.6-1.el10_0 | [ELSA-2025-13941](https://patchblox.com/security/data/fix/linux/elsa-2025-13941.md) | Aug 18, 2025 | | Linux | golang-bin ol 8 | 0:1.24.6-1.module+el8.10.0+90641+f7c45302 | [ELSA-2025-13940](https://patchblox.com/security/data/fix/linux/elsa-2025-13940.md) | Aug 18, 2025 | | Linux | golang-bin ol 9 | 0:1.24.6-1.el9_6 | [ELSA-2025-13935](https://patchblox.com/security/data/fix/linux/elsa-2025-13935.md) | Aug 17, 2025 | | Linux | golang-docs RHEL 8 | 0:1.24.6-1.module+el8.10.0+23407+428597c7 | [RHSA-2025:13940](https://patchblox.com/security/data/fix/linux/rhsa-2025-13940.md) | Aug 18, 2025 | | Linux | golang-docs RHEL 9 | 0:1.24.6-1.el9_6 | [RHSA-2025:13935](https://patchblox.com/security/data/fix/linux/rhsa-2025-13935.md) | Aug 18, 2025 | | Linux | golang-docs almalinux 10 | 1.24.6-1.el10_0.alma.1 | [ALSA-2025:13941](https://patchblox.com/security/data/fix/linux/alsa-2025-13941.md) | Aug 18, 2025 | | Linux | golang-docs almalinux 8 | 1.24.6-1.module_el8.10.0+4033+4bf8b620 | [ALSA-2025:13940](https://patchblox.com/security/data/fix/linux/alsa-2025-13940.md) | Aug 18, 2025 | | Linux | golang-docs almalinux 9 | 1.24.6-1.el9_6 | [ALSA-2025:13935](https://patchblox.com/security/data/fix/linux/alsa-2025-13935.md) | Aug 18, 2025 | | Linux | golang-docs amzn 2023 | 1.24.5-1.amzn2023.0.1 | [ALAS2023-2025-1104](https://patchblox.com/security/data/fix/linux/alas2023-2025-1104.md) | Jul 21, 2025 | | Linux | golang-docs ol 10 | 0:1.24.6-1.el10_0 | [ELSA-2025-13941](https://patchblox.com/security/data/fix/linux/elsa-2025-13941.md) | Aug 18, 2025 | | Linux | golang-docs ol 8 | 0:1.24.6-1.module+el8.10.0+90641+f7c45302 | [ELSA-2025-13940](https://patchblox.com/security/data/fix/linux/elsa-2025-13940.md) | Aug 18, 2025 | | Linux | golang-docs ol 9 | 0:1.24.6-1.el9_6 | [ELSA-2025-13935](https://patchblox.com/security/data/fix/linux/elsa-2025-13935.md) | Aug 17, 2025 | | Linux | golang-misc RHEL 8 | 0:1.24.6-1.module+el8.10.0+23407+428597c7 | [RHSA-2025:13940](https://patchblox.com/security/data/fix/linux/rhsa-2025-13940.md) | Aug 18, 2025 | | Linux | golang-misc RHEL 9 | 0:1.24.6-1.el9_6 | [RHSA-2025:13935](https://patchblox.com/security/data/fix/linux/rhsa-2025-13935.md) | Aug 18, 2025 | | Linux | golang-misc almalinux 10 | 1.24.6-1.el10_0.alma.1 | [ALSA-2025:13941](https://patchblox.com/security/data/fix/linux/alsa-2025-13941.md) | Aug 18, 2025 | | Linux | golang-misc almalinux 8 | 1.24.6-1.module_el8.10.0+4033+4bf8b620 | [ALSA-2025:13940](https://patchblox.com/security/data/fix/linux/alsa-2025-13940.md) | Aug 18, 2025 | | Linux | golang-misc almalinux 9 | 1.24.6-1.el9_6 | [ALSA-2025:13935](https://patchblox.com/security/data/fix/linux/alsa-2025-13935.md) | Aug 18, 2025 | | Linux | golang-misc amzn 2023 | 1.24.5-1.amzn2023.0.1 | [ALAS2023-2025-1104](https://patchblox.com/security/data/fix/linux/alas2023-2025-1104.md) | Jul 21, 2025 | | Linux | golang-misc ol 10 | 0:1.24.6-1.el10_0 | [ELSA-2025-13941](https://patchblox.com/security/data/fix/linux/elsa-2025-13941.md) | Aug 18, 2025 | | Linux | golang-misc ol 8 | 0:1.24.6-1.module+el8.10.0+90641+f7c45302 | [ELSA-2025-13940](https://patchblox.com/security/data/fix/linux/elsa-2025-13940.md) | Aug 18, 2025 | | Linux | golang-misc ol 9 | 0:1.24.6-1.el9_6 | [ELSA-2025-13935](https://patchblox.com/security/data/fix/linux/elsa-2025-13935.md) | Aug 17, 2025 | | Linux | golang-race RHEL 9 | 0:1.24.6-1.el9_6 | [RHSA-2025:13935](https://patchblox.com/security/data/fix/linux/rhsa-2025-13935.md) | Aug 18, 2025 | | Linux | golang-race almalinux 9 | 1.24.6-1.el9_6 | [ALSA-2025:13935](https://patchblox.com/security/data/fix/linux/alsa-2025-13935.md) | Aug 18, 2025 | | Linux | golang-race ol 10 | 0:1.24.6-1.el10_0 | [ELSA-2025-13941](https://patchblox.com/security/data/fix/linux/elsa-2025-13941.md) | Aug 18, 2025 | | Linux | golang-race ol 9 | 0:1.24.6-1.el9_6 | [ELSA-2025-13935](https://patchblox.com/security/data/fix/linux/elsa-2025-13935.md) | Aug 17, 2025 | | Linux | golang-shared amzn 2023 | 1.24.5-1.amzn2023.0.1 | [ALAS2023-2025-1104](https://patchblox.com/security/data/fix/linux/alas2023-2025-1104.md) | Jul 21, 2025 | | Linux | golang-src RHEL 8 | 0:1.24.6-1.module+el8.10.0+23407+428597c7 | [RHSA-2025:13940](https://patchblox.com/security/data/fix/linux/rhsa-2025-13940.md) | Aug 18, 2025 | | Linux | golang-src RHEL 9 | 0:1.24.6-1.el9_6 | [RHSA-2025:13935](https://patchblox.com/security/data/fix/linux/rhsa-2025-13935.md) | Aug 18, 2025 | | Linux | golang-src almalinux 10 | 1.24.6-1.el10_0.alma.1 | [ALSA-2025:13941](https://patchblox.com/security/data/fix/linux/alsa-2025-13941.md) | Aug 18, 2025 | | Linux | golang-src almalinux 8 | 1.24.6-1.module_el8.10.0+4033+4bf8b620 | [ALSA-2025:13940](https://patchblox.com/security/data/fix/linux/alsa-2025-13940.md) | Aug 18, 2025 | | Linux | golang-src almalinux 9 | 1.24.6-1.el9_6 | [ALSA-2025:13935](https://patchblox.com/security/data/fix/linux/alsa-2025-13935.md) | Aug 18, 2025 | | Linux | golang-src amzn 2023 | 1.24.5-1.amzn2023.0.1 | [ALAS2023-2025-1104](https://patchblox.com/security/data/fix/linux/alas2023-2025-1104.md) | Jul 21, 2025 | | Linux | golang-src ol 10 | 0:1.24.6-1.el10_0 | [ELSA-2025-13941](https://patchblox.com/security/data/fix/linux/elsa-2025-13941.md) | Aug 18, 2025 | | Linux | golang-src ol 8 | 0:1.24.6-1.module+el8.10.0+90641+f7c45302 | [ELSA-2025-13940](https://patchblox.com/security/data/fix/linux/elsa-2025-13940.md) | Aug 18, 2025 | | Linux | golang-src ol 9 | 0:1.24.6-1.el9_6 | [ELSA-2025-13935](https://patchblox.com/security/data/fix/linux/elsa-2025-13935.md) | Aug 17, 2025 | | Linux | golang-tests RHEL 8 | 0:1.24.6-1.module+el8.10.0+23407+428597c7 | [RHSA-2025:13940](https://patchblox.com/security/data/fix/linux/rhsa-2025-13940.md) | Aug 18, 2025 | | Linux | golang-tests RHEL 9 | 0:1.24.6-1.el9_6 | [RHSA-2025:13935](https://patchblox.com/security/data/fix/linux/rhsa-2025-13935.md) | Aug 18, 2025 | | Linux | golang-tests almalinux 10 | 1.24.6-1.el10_0.alma.1 | [ALSA-2025:13941](https://patchblox.com/security/data/fix/linux/alsa-2025-13941.md) | Aug 18, 2025 | | Linux | golang-tests almalinux 8 | 1.24.6-1.module_el8.10.0+4033+4bf8b620 | [ALSA-2025:13940](https://patchblox.com/security/data/fix/linux/alsa-2025-13940.md) | Aug 18, 2025 | | Linux | golang-tests almalinux 9 | 1.24.6-1.el9_6 | [ALSA-2025:13935](https://patchblox.com/security/data/fix/linux/alsa-2025-13935.md) | Aug 18, 2025 | | Linux | golang-tests amzn 2023 | 1.24.5-1.amzn2023.0.1 | [ALAS2023-2025-1104](https://patchblox.com/security/data/fix/linux/alas2023-2025-1104.md) | Jul 21, 2025 | | Linux | golang-tests ol 10 | 0:1.24.6-1.el10_0 | [ELSA-2025-13941](https://patchblox.com/security/data/fix/linux/elsa-2025-13941.md) | Aug 18, 2025 | | Linux | golang-tests ol 8 | 0:1.24.6-1.module+el8.10.0+90641+f7c45302 | [ELSA-2025-13940](https://patchblox.com/security/data/fix/linux/elsa-2025-13940.md) | Aug 18, 2025 | | Linux | golang-tests ol 9 | 0:1.24.6-1.el9_6 | [ELSA-2025-13935](https://patchblox.com/security/data/fix/linux/elsa-2025-13935.md) | Aug 17, 2025 | --- Data as of 2026-11-08T06:59:42Z UTC. Source: Patchblox Patch Radar (https://patchblox.com/security/patch-radar). Patchblox finds out-of-date software on Windows, macOS and Linux and updates it through release rings: https://patchblox.com/demo Free to use with attribution: show "Data: Patchblox Patch Radar" with a link to https://patchblox.com/security/patch-radar. Terms, including what needs a written agreement: https://patchblox.com/security/patch-radar/use-the-data Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.