CVE-2025-61731
High · 7.8CVSS
7.8
EPSS
0.6%
Published
Jan 28, 2026
CISA due date
—
The record
Building a malicious file with cmd/go can cause can cause a write to an attacker-controlled file with partial control of the file content. The "#cgo pkg-config:" directive in a Go source file provides command-line arguments to provide to the Go pkg-config command. An attacker can provide a "--log-file" argument to this directive, causing pkg-config to write to an attacker-controlled location.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| Go | toolchain | 0 | 1.24.12 |
| Bitnami | golang | 0 | 1.24.12 |
| Chainguard | aactl | 0 | 0.4.12-r40 |
| Chainguard | actions-runner-controller | 0 | 0.13.1-r1 |
| Chainguard | actions-runner-controller-fips | 0 | 0.13.1-r1 |
| Chainguard | age | 0 | 1.3.1-r1 |
| Chainguard | age-fips | 0 | 1.3.1-r1 |
| Chainguard | agentbeat | 0 | 9.2.4-r1 |
| Chainguard | agentbeat-fips | 0 | 9.2.4-r1 |
| Chainguard | amass | 0 | 5.0.1-r4 |
| Chainguard | amazon-cloudwatch-agent-amazon-cloudwatch-agent-config-wizard-fips | 0 | 1.300064.0-r1 |
| Chainguard | amazon-cloudwatch-agent-config-downloader-fips | 0 | 1.300064.0-r1 |
| Chainguard | amazon-cloudwatch-agent-config-translator-fips | 0 | 1.300064.0-r1 |
| Chainguard | amazon-cloudwatch-agent-operator | 0 | 3.3.1-r1 |
| Chainguard | amazon-cloudwatch-agent-operator-fips | 0 | 3.3.1-r1 |
| Chainguard | amazon-k8s-cni-fips | 0 | 1.21.1-r3 |
| Chainguard | amazon-k8s-cni-init-fips | 0 | 1.21.1-r3 |
| Chainguard | amazon-k8s-cni-init-fips-compat | 0 | 1.21.1-r3 |
| Chainguard | amazon-ssm-agent-ecs-exec-fips | 0 | 3.3.3270.0-r4 |
| Chainguard | amazon-ssm-agent-fips | 0 | 3.3.3270.0-r4 |
| Chainguard | amazon-vpc-cni-plugins | 0 | 1.3_git20251112-r4 |
| Chainguard | amazon-vpc-cni-plugins-fips | 0 | 1.3_git20251112-r4 |
| Chainguard | apache-exporter | 0 | 1.0.12-r1 |
| Chainguard | apm-server-7.17 | 0 | 7.17.29-r8 |
| Chainguard | apm-server-8.17 | 0 | 8.17.10-r6 |
| Chainguard | apm-server-8.18 | 0 | 8.18.8-r5 |
| Chainguard | apm-server-8.19 | 0 | 8.19.10-r1 |
| Chainguard | apm-server-9.0 | 0 | 9.0.8-r3 |
| Chainguard | apm-server-9.1 | 0 | 9.1.10-r1 |
| Chainguard | apm-server-fips-7.17 | 0 | 7.17.29-r8 |
| Chainguard | apm-server-fips-8.17 | 0 | 8.17.10-r4 |
| Chainguard | apm-server-fips-8.18 | 0 | 8.18.8-r5 |
| Chainguard | apm-server-fips-8.19 | 0 | 8.19.10-r1 |
| Chainguard | apm-server-fips-9.0 | 0 | 9.0.8-r3 |
| Chainguard | argo-cd-2.14 | 0 | 2.14.21-r5 |
| Chainguard | argo-cd-2.14-compat | 0 | 2.14.21-r5 |
| Chainguard | argo-cd-3.0 | 0 | 3.0.23-r0 |
| Chainguard | argo-cd-3.0-compat | 0 | 3.0.23-r0 |
| Chainguard | argo-cd-fips-2.14 | 0 | 2.14.21-r5 |
| Chainguard | argo-cd-fips-2.14-compat | 0 | 2.14.21-r5 |
| Chainguard | argo-rollouts-fips | 0 | 1.8.3-r8 |
| Chainguard | auditbeat-8.19 | 0 | 8.19.10-r1 |
| Chainguard | auditbeat-9.0 | 0 | 9.0.8-r5 |
| Chainguard | auditbeat-9.1 | 0 | 9.1.10-r1 |
| Chainguard | auditbeat-9.2 | 0 | 9.2.4-r1 |
| Chainguard | auditbeat-fips-7 | 0 | 7.17.29-r11 |
| Chainguard | auditbeat-fips-8.18 | 0 | 8.18.8-r4 |
| Chainguard | auditbeat-fips-8.19 | 0 | 8.19.10-r1 |
| Chainguard | auditbeat-fips-9.0 | 0 | 9.0.8-r4 |
| Chainguard | authservice | 0 | 1.1.5-r1 |
| Chainguard | authservice-fips | 0 | 1.1.5-r1 |
| Chainguard | aws-ebs-csi-driver-fips-1.50 | 0 | 1.50.3-r2 |
| Chainguard | aws-ebs-csi-driver-fips-1.51 | 0 | 1.51.2-r2 |
| Chainguard | aws-ebs-csi-driver-fips-1.52 | 0 | 1.52.1-r2 |
| Chainguard | aws-ebs-csi-driver-fips-1.53 | 0 | 1.53.0-r2 |
| Chainguard | aws-eks-pod-identity-agent | 0 | 0.1.36-r2 |
| Chainguard | aws-eks-pod-identity-agent-fips | 0 | 0.1.36-r2 |
| Chainguard | aws-flb-cloudwatch | 0 | 1.9.4-r23 |
| Chainguard | aws-flb-cloudwatch-fips | 0 | 1.9.4-r17 |
| Chainguard | aws-flb-kinesis | 0 | 1.10.3-r4 |
| Chainguard | aws-flb-kinesis-fips | 0 | 1.10.3-r5 |
| Chainguard | aws-fsx-csi-driver | 0 | 1.8.0-r1 |
| Chainguard | aws-iam-authenticator | 0 | 0.7.10-r1 |
| Chainguard | aws-iam-authenticator-fips | 0 | 0.7.10-r1 |
| Chainguard | aws-network-policy-agent-fips | 0 | 1.3.1-r1 |
| Chainguard | aws-privateca-issuer | 0 | 1.8.0-r1 |
| Chainguard | aws-privateca-issuer-fips | 0 | 1.8.0-r1 |
| Chainguard | aws-signer-notation-plugin | 0 | 1.0.2292-r5 |
| Chainguard | aws-signer-notation-plugin-fips | 0 | 1.0.2292-r5 |
| Chainguard | aws-sigv4-proxy | 0 | 1.11-r1 |
| Chainguard | aws-sigv4-proxy-fips | 0 | 1.11-r1 |
| Chainguard | azcopy | 0 | 10.31.1-r1 |
| Chainguard | azure-aad-pod-identity-mic | 0 | 1.8.17-r32 |
| Chainguard | azure-aad-pod-identity-nmi | 0 | 1.8.17-r32 |
| Chainguard | azure-ipam | 0 | 0.4.0-r8 |
| Chainguard | azure-ipam-dropgz | 0 | 0.4.0-r8 |
| Chainguard | azure-service-operator | 0 | 2.17.0-r1 |
| Chainguard | azure-service-operator-fips | 0 | 2.17.0-r1 |
| Chainguard | azure-vnet-cni | 0 | 1.7.12-r1 |
| Chainguard | azure-workload-identity-webhook | 0 | 1.5.1-r6 |
| Chainguard | azuredisk-csi-1.28 | 0 | 1.28.12-r12 |
| Chainguard | azuredisk-csi-1.30 | 0 | 1.30.12-r10 |
| Chainguard | azuredisk-csi-fips-1.29 | 0 | 1.29.14-r11 |
| Chainguard | azuredisk-csi-fips-1.31 | 0 | 1.31.12-r6 |
| Chainguard | azurefile-csi-1.29 | 0 | 1.29.12-r10 |
| Chainguard | azurefile-csi-1.30 | 0 | 1.30.10-r10 |
| Chainguard | azurefile-csi-1.31 | 0 | 1.31.8-r6 |
| Chainguard | azurefile-csi-1.32 | 0 | 1.32.9-r1 |
| Chainguard | azurefile-csi-1.33 | 0 | 1.33.7-r1 |
| Chainguard | azurefile-csi-1.34 | 0 | 1.34.3-r1 |
| Chainguard | azurefile-csi-fips-1.29 | 0 | 1.29.12-r10 |
| Chainguard | azurefile-csi-fips-1.31 | 0 | 1.31.8-r6 |
| Chainguard | azurefile-csi-fips-1.32 | 0 | 1.32.9-r1 |
| Chainguard | azurefile-csi-fips-1.34 | 0 | 1.34.3-r1 |
| Chainguard | bank-vaults-template | 0 | 1.32.1-r1 |
| Chainguard | bento | 0 | 1.14.1-r1 |
| Chainguard | blob-csi-1.23 | 0 | 1.23.11-r63 |
| Chainguard | blob-csi-1.24 | 0 | 1.24.11-r12 |
| Chainguard | blob-csi-fips-1.23 | 0 | 1.23.11-r64 |
| Chainguard | blob-csi-fips-1.24 | 0 | 1.24.11-r12 |
| Chainguard | blob-csi-fips-1.25 | 0 | 1.25.10-r7 |
| Chainguard | blobfuse2 | 0 | 2.4.2-r8 |
| Chainguard | blobfuse2-fips-health-monitor | 0 | 2.4.2-r9 |
| Chainguard | bom | 0 | 0.7.1-r4 |
| Chainguard | boring-registry | 0 | 0.16.6-r5 |
| Chainguard | boring-registry-fips | 0 | 0.16.6-r5 |
| Chainguard | boringssl-fips-static-2023042800-tools | 0 | 2023042800-r9 |
| Chainguard | boringssl-fips-static-20240407-tools | 0 | 20240407-r1 |
| Chainguard | buildtools-buildifier-fips | 0 | 8.5.1-r0 |
| Chainguard | buildtools-buildozer-fips | 0 | 8.5.1-r0 |
| Chainguard | cadvisor-fips | 0 | 0.56.2-r1 |
| Chainguard | calico-apiserver-3.29 | 0 | 3.29.7-r5 |
| Chainguard | calico-app-policy-3.29 | 0 | 3.29.7-r5 |
| Chainguard | calico-app-policy-3.31 | 0 | 3.31.3-r2 |
| Chainguard | calico-cni-3.29 | 0 | 3.29.7-r5 |
| Chainguard | calico-felix-3.29 | 0 | 3.29.7-r5 |
| Chainguard | calico-felix-3.31 | 0 | 3.31.3-r2 |
| Chainguard | calico-key-cert-provisioner-3.29 | 0 | 3.29.7-r5 |
| Chainguard | calico-key-cert-provisioner-fips-3.31 | 0 | 3.31.3-r2 |
| Chainguard | calico-kube-controllers-3.29 | 0 | 3.29.7-r5 |
| Chainguard | calico-kube-controllers-fips-3.31 | 0 | 3.31.3-r2 |
| Chainguard | calico-node-3.29 | 0 | 3.29.7-r5 |
| Chainguard | calico-pod2daemon-3.29 | 0 | 3.29.7-r5 |
| Chainguard | calico-pod2daemon-fips-3.31 | 0 | 3.31.3-r2 |
| Chainguard | calico-typha-client-3.29 | 0 | 3.29.7-r5 |
| Chainguard | calico-typha-client-fips-3.31 | 0 | 3.31.3-r2 |
| Chainguard | calico-typhad-3.29 | 0 | 3.29.7-r5 |
| Chainguard | calico-whisker-backend-fips-3.31 | 0 | 3.31.3-r2 |
| Chainguard | calicoctl-3.29 | 0 | 3.29.7-r5 |
| Chainguard | calicoctl-3.31 | 0 | 3.31.3-r2 |
| Chainguard | calicoctl-fips-3.31 | 0 | 3.31.3-r2 |
| Chainguard | capslock | 0 | 0.3.1-r1 |
| Chainguard | cargobump | 0 | 0.1.0-r9 |
| Chainguard | cass-operator | 0 | 1.28.0-r3 |
| Chainguard | cass-operator-fips | 0 | 1.29.0-r2 |
| Chainguard | ceph-csi-operator | 0 | 0.4.1-r3 |
| Chainguard | ceph-csi-operator-fips | 0 | 0.4.1-r2 |
| Chainguard | cephcsi | 0 | 3.16.1-r1 |
| Chainguard | cephcsi-fips | 0 | 3.16.1-r0 |
| Chainguard | cerbos-fips | 0 | 0.51.0-r0 |
| Chainguard | cerbosctl-fips | 0 | 0.51.0-r0 |
| Chainguard | cert-manager-acmesolver-fips-1.17 | 0 | 1.17.4-r6 |
| Chainguard | cert-manager-acmesolver-fips-1.19 | 0 | 1.19.2-r1 |
| Chainguard | cert-manager-cainjector-fips-1.17 | 0 | 1.17.4-r6 |
| Chainguard | cert-manager-cainjector-fips-1.19 | 0 | 1.19.2-r1 |
| Chainguard | cert-manager-cmctl | 0 | 2.4.0-r2 |
| Chainguard | cert-manager-cmctl-fips | 0 | 2.4.0-r2 |
| Chainguard | cert-manager-controller-fips-1.17 | 0 | 1.17.4-r6 |
| Chainguard | cert-manager-controller-fips-1.19 | 0 | 1.19.2-r1 |
| Chainguard | cert-manager-csi-driver-fips | 0 | 0.12.0-r1 |
| Chainguard | cert-manager-fips-1.17 | 0 | 1.17.4-r6 |
| Chainguard | cert-manager-google-cas-issuer | 0 | 0.10.2-r1 |
| Chainguard | cert-manager-istio-csr | 0 | 0.15.0-r1 |
| Chainguard | cert-manager-istio-csr-fips | 0 | 0.15.0-r1 |
| Chainguard | cert-manager-openshift-routes | 0 | 0.8.4-r1 |
| Chainguard | cert-manager-openshift-routes-fips | 0 | 0.8.4-r1 |
| Chainguard | cert-manager-startupapicheck-fips-1.17 | 0 | 1.17.4-r6 |
| Chainguard | cert-manager-startupapicheck-fips-1.19 | 0 | 1.19.2-r1 |
| Chainguard | cert-manager-webhook-fips-1.17 | 0 | 1.17.4-r6 |
| Chainguard | cert-manager-webhook-fips-1.19 | 0 | 1.19.2-r1 |
| Chainguard | cert-manager-webhook-pdns-fips | 0 | 2.5.3-r5 |
| Chainguard | cfssl | 0 | 1.6.5-r26 |
| Chainguard | cfssl-bundle | 0 | 1.6.5-r26 |
| Chainguard | chaos-mesh-fips | 0 | 2.8.1-r1 |
| Chainguard | chart-testing | 0 | 3.14.0-r3 |
| Chainguard | chart-testing-fips | 0 | 3.14.0-r5 |
| Chainguard | chisel | 0 | 1.11.3-r5 |
| Chainguard | chisel-fips | 0 | 1.11.4-r1 |
| Chainguard | cilium-certgen-0.1 | 0 | 0.1.20-r3 |
| Chainguard | cilium-cli | 0 | 0.19.0-r1 |
| Chainguard | cilium-envoy-1.15 | 0 | 1.15.19-r7 |
| Chainguard | cilium-envoy-1.16 | 0 | 1.16.19-r1 |
| Chainguard | cilium-envoy-fips-1.15 | 0 | 1.15.19-r8 |
| Chainguard | cilium-envoy-fips-1.16 | 0 | 1.16.19-r1 |
| Chainguard | cis-operator-1.2 | 0 | 1.2.7-r7 |
| Chainguard | cis-operator-1.3 | 0 | 1.3.10-r2 |
| Chainguard | clickhouse-operator-fips-metrics-exporter | 0 | 0.25.6-r1 |
| Chainguard | clickhouse-operator-metrics-exporter | 0 | 0.25.6-r1 |
| Chainguard | cloud-provider-aws-1.28-cloud-controller-manager | 0 | 1.28.11-r42 |
| Chainguard | cloud-provider-aws-1.29-ecr-credential-provider | 0 | 1.29.10-r3 |
| Chainguard | cloud-provider-aws-1.31-cloud-controller-manager | 0 | 1.31.9-r2 |
| Chainguard | cloud-provider-aws-1.32-cloud-controller-manager | 0 | 1.32.5-r3 |
| Chainguard | cloud-provider-aws-1.32-ecr-credential-provider | 0 | 1.32.5-r3 |
| Chainguard | cloud-provider-aws-1.33-cloud-controller-manager | 0 | 1.33.2-r4 |
| Chainguard | cloud-provider-aws-1.33-ecr-credential-provider | 0 | 1.33.2-r4 |
| Chainguard | cloud-provider-aws-1.34-cloud-controller-manager | 0 | 1.34.1-r4 |
| Chainguard | cloud-provider-aws-fips-1.28-ecr-credential-provider | 0 | 1.28.11-r13 |
| Chainguard | cloud-provider-aws-fips-1.29-cloud-controller-manager | 0 | 1.29.10-r3 |
| Chainguard | cloud-provider-aws-fips-1.29-ecr-credential-provider | 0 | 1.29.10-r3 |
| Chainguard | cloud-provider-aws-fips-1.31-cloud-controller-manager | 0 | 1.31.9-r3 |
| Chainguard | cloud-provider-aws-fips-1.31-ecr-credential-provider | 0 | 1.31.9-r3 |
| Chainguard | cloud-provider-aws-fips-1.32-cloud-controller-manager | 0 | 1.32.5-r3 |
| Chainguard | cloud-provider-aws-fips-1.32-ecr-credential-provider | 0 | 1.32.5-r3 |
| Chainguard | cloud-provider-aws-fips-1.33-cloud-controller-manager | 0 | 1.33.2-r3 |
| Chainguard | cloud-provider-aws-fips-1.33-ecr-credential-provider | 0 | 1.33.2-r3 |
| Chainguard | cloud-provider-aws-fips-1.34-cloud-controller-manager | 0 | 1.34.1-r4 |
| Chainguard | cloud-provider-aws-fips-1.34-ecr-credential-provider | 0 | 1.34.1-r4 |
| Chainguard | cloud-provider-azure-cloud-controller-manager-1.31 | 0 | 1.31.12-r3 |
| Chainguard | cloud-provider-azure-cloud-controller-manager-1.32 | 0 | 1.32.11-r2 |
| Chainguard | cloud-provider-azure-cloud-controller-manager-1.33 | 0 | 1.33.6-r2 |
Related vulnerabilities
- CVE-2025-61732 A discrepancy between how Go and C/C++ comments were parsed allowed for code smuggling… Also affects toolchain
- CVE-2025-68119 Downloading and building modules with malicious version strings can cause local code… Also affects toolchain
- CVE-2023-24531 Command go env is documented as outputting a shell script containing the Go environment. Also affects toolchain
- CVE-2025-61726 The net/url package does not set a limit on the number of query parameters in a query. Also affects golang
- CVE-2025-61728 archive/zip uses a super-linear file name indexing algorithm that is invoked the first… Also affects golang
- CVE-2025-61730 During the TLS 1.3 handshake if multiple messages are sent in records that span… Also affects golang
- CVE-2025-61727 An excluded subdomain constraint in a certificate chain does not restrict the usage of… Also affects golang
- CVE-2025-61729 Within HostnameError.Error(), when constructing an error string, there is no limit to the… Also affects golang