{"resultsPerPage":1,"startIndex":0,"totalResults":1,"format":"NVD_CVE","version":"2.0","timestamp":"2026-05-19T20:58:01.207","vulnerabilities":[{"cve":{"id":"CVE-2025-68119","sourceIdentifier":"security@golang.org","published":"2026-01-28T20:16:11.443","lastModified":"2026-02-06T18:40:50.040","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"Downloading and building modules with malicious version strings can cause local code execution. On systems with Mercurial (hg) installed, downloading modules from non-standard sources (e.g., custom domains) can cause unexpected code execution due to how external VCS commands are constructed. This issue can also be triggered by providing a malicious version string to the toolchain. On systems with Git installed, downloading and building modules with malicious version strings can allow an attacker to write to arbitrary files on the filesystem. This can only be triggered by explicitly providing the malicious version strings to the toolchain and does not affect usage of @latest or bare module paths."},{"lang":"es","value":"Descargar y construir módulos con cadenas de versión maliciosas puede causar la ejecución de código local. En sistemas con Mercurial (hg) instalado, descargar módulos de fuentes no estándar (por ejemplo, dominios personalizados) puede causar la ejecución de código inesperada debido a cómo se construyen los comandos VCS externos. Este problema también puede ser provocado al proporcionar una cadena de versión maliciosa a la cadena de herramientas. En sistemas con Git instalado, descargar y construir módulos con cadenas de versión maliciosas puede permitir a un atacante escribir en archivos arbitrarios en el sistema de archivos. Esto solo puede ser provocado al proporcionar explícitamente las cadenas de versión maliciosas a la cadena de herramientas y no afecta el uso de @latest o rutas de módulo bare."}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":7.0,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"HIGH","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.0,"impactScore":5.9}]},"weaknesses":[{"source":"nvd@nist.gov","type":"Primary","description":[{"lang":"en","value":"CWE-787"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:golang:go:*:*:*:*:*:*:*:*","versionEndExcluding":"1.24.12","matchCriteriaId":"21FD9368-8AB3-404B-8599-BBF64EFE3C7B"},{"vulnerable":true,"criteria":"cpe:2.3:a:golang:go:*:*:*:*:*:*:*:*","versionStartIncluding":"1.25.0","versionEndExcluding":"1.25.6","matchCriteriaId":"A547E844-78D2-4B17-B7A9-73E7B503D2CE"}]}]}],"references":[{"url":"https://go.dev/cl/736710","source":"security@golang.org","tags":["Patch"]},{"url":"https://go.dev/issue/77099","source":"security@golang.org","tags":["Issue Tracking","Patch"]},{"url":"https://groups.google.com/g/golang-announce/c/Vd2tYVM8eUc","source":"security@golang.org","tags":["Release Notes","Mailing List"]},{"url":"https://pkg.go.dev/vuln/GO-2026-4338","source":"security@golang.org","tags":["Vendor Advisory"]}]}}]}