CVE-2025-68119
High · 7.0CVSS
7.0
EPSS
0.4%
Published
Jan 28, 2026
CISA due date
—
The record
Downloading and building modules with malicious version strings can cause local code execution. On systems with Mercurial (hg) installed, downloading modules from non-standard sources (e.g., custom domains) can cause unexpected code execution due to how external VCS commands are constructed. This issue can also be triggered by providing a malicious version string to the toolchain. On systems with Git installed, downloading and building modules with malicious version strings can allow an attacker to write to arbitrary files on the filesystem. This can only be triggered by explicitly providing the malicious version strings to the toolchain and does not affect usage of @latest or bare module paths.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| Go | toolchain | 1.25.0 | 1.25.6 |
| Bitnami | golang | 1.25.0 | 1.25.6 |
| Chainguard | aactl | 0 | 0.4.12-r40 |
| Chainguard | actions-runner-controller | 0 | 0.13.1-r1 |
| Chainguard | actions-runner-controller-fips | 0 | 0.13.1-r1 |
| Chainguard | age | 0 | 1.3.1-r1 |
| Chainguard | age-fips | 0 | 1.3.1-r1 |
| Chainguard | agentbeat-fips | 0 | 9.2.4-r1 |
| Chainguard | amass | 0 | 5.0.1-r4 |
| Chainguard | amazon-cloudwatch-agent-amazon-cloudwatch-agent-config-wizard-fips | 0 | 1.300064.0-r1 |
| Chainguard | amazon-cloudwatch-agent-config-downloader-fips | 0 | 1.300064.0-r1 |
| Chainguard | amazon-cloudwatch-agent-config-translator-fips | 0 | 1.300064.0-r1 |
| Chainguard | amazon-cloudwatch-agent-operator | 0 | 3.3.1-r1 |
| Chainguard | amazon-cloudwatch-agent-operator-fips | 0 | 3.3.1-r1 |
| Chainguard | amazon-k8s-cni-fips | 0 | 1.21.1-r3 |
| Chainguard | amazon-k8s-cni-init-fips | 0 | 1.21.1-r3 |
| Chainguard | amazon-k8s-cni-init-fips-compat | 0 | 1.21.1-r3 |
| Chainguard | amazon-ssm-agent-ecs-exec-fips | 0 | 3.3.3270.0-r4 |
| Chainguard | amazon-ssm-agent-fips | 0 | 3.3.3270.0-r4 |
| Chainguard | amazon-vpc-cni-plugins | 0 | 1.3_git20251112-r4 |
| Chainguard | amazon-vpc-cni-plugins-fips | 0 | 1.3_git20251112-r4 |
| Chainguard | apache-exporter | 0 | 1.0.12-r1 |
| Chainguard | apm-server-7.17 | 0 | 7.17.29-r8 |
| Chainguard | apm-server-8.17 | 0 | 8.17.10-r5 |
| Chainguard | apm-server-8.18 | 0 | 8.18.8-r4 |
| Chainguard | apm-server-8.19 | 0 | 8.19.10-r1 |
| Chainguard | apm-server-9.1 | 0 | 9.1.10-r1 |
| Chainguard | apm-server-fips-7.17 | 0 | 7.17.29-r8 |
| Chainguard | apm-server-fips-8.17 | 0 | 8.17.10-r4 |
| Chainguard | apm-server-fips-8.18 | 0 | 8.18.8-r3 |
| Chainguard | apm-server-fips-8.19 | 0 | 8.19.10-r1 |
| Chainguard | argo-cd-2.14 | 0 | 2.14.21-r5 |
| Chainguard | argo-cd-2.14-compat | 0 | 2.14.21-r5 |
| Chainguard | argo-cd-3.0 | 0 | 3.0.23-r0 |
| Chainguard | argo-cd-3.0-compat | 0 | 3.0.23-r0 |
| Chainguard | argo-cd-fips-2.14 | 0 | 2.14.21-r5 |
| Chainguard | argo-cd-fips-2.14-compat | 0 | 2.14.21-r5 |
| Chainguard | argo-rollouts-fips | 0 | 1.8.3-r8 |
| Chainguard | auditbeat-8.19 | 0 | 8.19.10-r1 |
| Chainguard | auditbeat-9.0 | 0 | 9.0.8-r5 |
| Chainguard | auditbeat-9.1 | 0 | 9.1.10-r1 |
| Chainguard | auditbeat-9.2 | 0 | 9.2.4-r1 |
| Chainguard | auditbeat-fips-7 | 0 | 7.17.29-r9 |
| Chainguard | auditbeat-fips-8.18 | 0 | 8.18.8-r4 |
| Chainguard | auditbeat-fips-8.19 | 0 | 8.19.10-r1 |
| Chainguard | auditbeat-fips-9.0 | 0 | 9.0.8-r4 |
| Chainguard | authservice | 0 | 1.1.5-r1 |
| Chainguard | authservice-fips | 0 | 1.1.5-r1 |
| Chainguard | aws-ebs-csi-driver-fips-1.50 | 0 | 1.50.3-r2 |
| Chainguard | aws-ebs-csi-driver-fips-1.51 | 0 | 1.51.2-r2 |
| Chainguard | aws-ebs-csi-driver-fips-1.52 | 0 | 1.52.1-r2 |
| Chainguard | aws-ebs-csi-driver-fips-1.53 | 0 | 1.53.0-r2 |
| Chainguard | aws-eks-pod-identity-agent | 0 | 0.1.36-r2 |
| Chainguard | aws-eks-pod-identity-agent-fips | 0 | 0.1.36-r2 |
| Chainguard | aws-flb-cloudwatch | 0 | 1.9.4-r23 |
| Chainguard | aws-flb-cloudwatch-fips | 0 | 1.9.4-r17 |
| Chainguard | aws-flb-kinesis | 0 | 1.10.3-r4 |
| Chainguard | aws-flb-kinesis-fips | 0 | 1.10.3-r5 |
| Chainguard | aws-fsx-csi-driver | 0 | 1.8.0-r1 |
| Chainguard | aws-iam-authenticator | 0 | 0.7.10-r1 |
| Chainguard | aws-iam-authenticator-fips | 0 | 0.7.10-r1 |
| Chainguard | aws-network-policy-agent-fips | 0 | 1.3.1-r1 |
| Chainguard | aws-privateca-issuer | 0 | 1.8.0-r1 |
| Chainguard | aws-privateca-issuer-fips | 0 | 1.8.0-r1 |
| Chainguard | aws-signer-notation-plugin | 0 | 1.0.2292-r5 |
| Chainguard | aws-signer-notation-plugin-fips | 0 | 1.0.2292-r5 |
| Chainguard | aws-sigv4-proxy | 0 | 1.11-r1 |
| Chainguard | aws-sigv4-proxy-fips | 0 | 1.11-r1 |
| Chainguard | azcopy | 0 | 10.31.1-r1 |
| Chainguard | azure-aad-pod-identity-mic | 0 | 1.8.17-r32 |
| Chainguard | azure-aad-pod-identity-nmi | 0 | 1.8.17-r32 |
| Chainguard | azure-ipam | 0 | 0.4.0-r8 |
| Chainguard | azure-ipam-dropgz | 0 | 0.4.0-r8 |
| Chainguard | azure-service-operator | 0 | 2.17.0-r1 |
| Chainguard | azure-service-operator-fips | 0 | 2.17.0-r1 |
| Chainguard | azure-vnet-cni | 0 | 1.7.12-r1 |
| Chainguard | azure-workload-identity-webhook | 0 | 1.5.1-r6 |
| Chainguard | azuredisk-csi-1.28 | 0 | 1.28.12-r12 |
| Chainguard | azuredisk-csi-1.30 | 0 | 1.30.12-r10 |
| Chainguard | azuredisk-csi-fips-1.29 | 0 | 1.29.14-r11 |
| Chainguard | azuredisk-csi-fips-1.31 | 0 | 1.31.12-r6 |
| Chainguard | azurefile-csi-1.29 | 0 | 1.29.12-r10 |
| Chainguard | azurefile-csi-1.30 | 0 | 1.30.10-r10 |
| Chainguard | azurefile-csi-1.31 | 0 | 1.31.8-r6 |
| Chainguard | azurefile-csi-1.32 | 0 | 1.32.9-r1 |
| Chainguard | azurefile-csi-1.33 | 0 | 1.33.7-r1 |
| Chainguard | azurefile-csi-1.34 | 0 | 1.34.3-r1 |
| Chainguard | azurefile-csi-fips-1.29 | 0 | 1.29.12-r10 |
| Chainguard | azurefile-csi-fips-1.31 | 0 | 1.31.8-r6 |
| Chainguard | azurefile-csi-fips-1.32 | 0 | 1.32.9-r1 |
| Chainguard | azurefile-csi-fips-1.34 | 0 | 1.34.3-r1 |
| Chainguard | bank-vaults-template | 0 | 1.32.1-r1 |
| Chainguard | bento | 0 | 1.14.1-r1 |
| Chainguard | blob-csi-1.23 | 0 | 1.23.11-r63 |
| Chainguard | blob-csi-1.24 | 0 | 1.24.11-r12 |
| Chainguard | blob-csi-fips-1.23 | 0 | 1.23.11-r64 |
| Chainguard | blob-csi-fips-1.24 | 0 | 1.24.11-r12 |
| Chainguard | blob-csi-fips-1.25 | 0 | 1.25.10-r7 |
| Chainguard | blobfuse2 | 0 | 2.4.2-r8 |
| Chainguard | blobfuse2-fips-health-monitor | 0 | 2.4.2-r9 |
| Chainguard | bom | 0 | 0.7.1-r4 |
| Chainguard | boring-registry | 0 | 0.16.6-r5 |
| Chainguard | boring-registry-fips | 0 | 0.16.6-r5 |
| Chainguard | boringssl-fips-static-2023042800-tools | 0 | 2023042800-r9 |
| Chainguard | boringssl-fips-static-20240407-tools | 0 | 20240407-r1 |
| Chainguard | buildtools-buildifier-fips | 0 | 8.5.1-r0 |
| Chainguard | buildtools-buildozer-fips | 0 | 8.5.1-r0 |
| Chainguard | cadvisor-fips | 0 | 0.56.2-r1 |
| Chainguard | calico-apiserver-3.29 | 0 | 3.29.7-r5 |
| Chainguard | calico-app-policy-3.29 | 0 | 3.29.7-r5 |
| Chainguard | calico-app-policy-3.31 | 0 | 3.31.3-r2 |
| Chainguard | calico-cni-3.29 | 0 | 3.29.7-r5 |
| Chainguard | calico-felix-3.29 | 0 | 3.29.7-r5 |
| Chainguard | calico-felix-3.31 | 0 | 3.31.3-r2 |
| Chainguard | calico-key-cert-provisioner-3.29 | 0 | 3.29.7-r5 |
| Chainguard | calico-key-cert-provisioner-fips-3.31 | 0 | 3.31.3-r2 |
| Chainguard | calico-kube-controllers-3.29 | 0 | 3.29.7-r5 |
| Chainguard | calico-kube-controllers-fips-3.31 | 0 | 3.31.3-r2 |
| Chainguard | calico-node-3.29 | 0 | 3.29.7-r5 |
| Chainguard | calico-pod2daemon-3.29 | 0 | 3.29.7-r5 |
| Chainguard | calico-pod2daemon-fips-3.31 | 0 | 3.31.3-r2 |
| Chainguard | calico-typha-client-3.29 | 0 | 3.29.7-r5 |
| Chainguard | calico-typha-client-fips-3.31 | 0 | 3.31.3-r2 |
| Chainguard | calico-typhad-3.29 | 0 | 3.29.7-r5 |
| Chainguard | calico-whisker-backend-fips-3.31 | 0 | 3.31.3-r2 |
| Chainguard | calicoctl-3.29 | 0 | 3.29.7-r5 |
| Chainguard | calicoctl-3.31 | 0 | 3.31.3-r2 |
| Chainguard | calicoctl-fips-3.31 | 0 | 3.31.3-r2 |
| Chainguard | capslock | 0 | 0.3.1-r1 |
| Chainguard | cargobump | 0 | 0.1.0-r9 |
| Chainguard | cass-operator | 0 | 1.28.0-r3 |
| Chainguard | cass-operator-fips | 0 | 1.28.0-r4 |
| Chainguard | ceph-csi-operator | 0 | 0.4.1-r3 |
| Chainguard | ceph-csi-operator-fips | 0 | 0.4.1-r2 |
| Chainguard | cephcsi | 0 | 3.16.1-r0 |
| Chainguard | cephcsi-fips | 0 | 3.16.1-r0 |
| Chainguard | cerbos-fips | 0 | 0.51.0-r0 |
| Chainguard | cerbosctl-fips | 0 | 0.51.0-r0 |
| Chainguard | cert-manager-acmesolver-fips-1.17 | 0 | 1.17.4-r6 |
| Chainguard | cert-manager-acmesolver-fips-1.19 | 0 | 1.19.2-r1 |
| Chainguard | cert-manager-cainjector-fips-1.17 | 0 | 1.17.4-r6 |
| Chainguard | cert-manager-cainjector-fips-1.19 | 0 | 1.19.2-r1 |
| Chainguard | cert-manager-cmctl | 0 | 2.4.0-r2 |
| Chainguard | cert-manager-cmctl-fips | 0 | 2.4.0-r2 |
| Chainguard | cert-manager-controller-fips-1.17 | 0 | 1.17.4-r6 |
| Chainguard | cert-manager-controller-fips-1.19 | 0 | 1.19.2-r1 |
| Chainguard | cert-manager-csi-driver-fips | 0 | 0.12.0-r1 |
| Chainguard | cert-manager-fips-1.17 | 0 | 1.17.4-r6 |
| Chainguard | cert-manager-google-cas-issuer | 0 | 0.10.2-r1 |
| Chainguard | cert-manager-istio-csr | 0 | 0.15.0-r1 |
| Chainguard | cert-manager-istio-csr-fips | 0 | 0.15.0-r1 |
| Chainguard | cert-manager-openshift-routes | 0 | 0.8.4-r1 |
| Chainguard | cert-manager-openshift-routes-fips | 0 | 0.8.4-r1 |
| Chainguard | cert-manager-startupapicheck-fips-1.17 | 0 | 1.17.4-r6 |
| Chainguard | cert-manager-startupapicheck-fips-1.19 | 0 | 1.19.2-r1 |
| Chainguard | cert-manager-webhook-fips-1.17 | 0 | 1.17.4-r6 |
| Chainguard | cert-manager-webhook-fips-1.19 | 0 | 1.19.2-r1 |
| Chainguard | cert-manager-webhook-pdns-fips | 0 | 2.5.3-r5 |
| Chainguard | cfssl | 0 | 1.6.5-r26 |
| Chainguard | cfssl-bundle | 0 | 1.6.5-r26 |
| Chainguard | chaos-mesh-fips | 0 | 2.8.1-r1 |
| Chainguard | chart-testing | 0 | 3.14.0-r3 |
| Chainguard | chart-testing-fips | 0 | 3.14.0-r3 |
| Chainguard | chisel | 0 | 1.11.3-r4 |
| Chainguard | chisel-fips | 0 | 1.11.3-r4 |
| Chainguard | cilium-certgen-0.1 | 0 | 0.1.20-r3 |
| Chainguard | cilium-cli | 0 | 0.19.0-r1 |
| Chainguard | cis-operator-1.2 | 0 | 1.2.7-r7 |
| Chainguard | cis-operator-1.3 | 0 | 1.3.10-r2 |
| Chainguard | clickhouse-operator-fips-metrics-exporter | 0 | 0.25.6-r1 |
| Chainguard | clickhouse-operator-metrics-exporter | 0 | 0.25.6-r1 |
| Chainguard | cloud-provider-aws-1.28-cloud-controller-manager | 0 | 1.28.11-r42 |
| Chainguard | cloud-provider-aws-1.29-ecr-credential-provider | 0 | 1.29.10-r3 |
| Chainguard | cloud-provider-aws-1.31-cloud-controller-manager | 0 | 1.31.9-r2 |
| Chainguard | cloud-provider-aws-1.32-cloud-controller-manager | 0 | 1.32.5-r3 |
| Chainguard | cloud-provider-aws-1.32-ecr-credential-provider | 0 | 1.32.5-r3 |
| Chainguard | cloud-provider-aws-1.33-cloud-controller-manager | 0 | 1.33.2-r4 |
| Chainguard | cloud-provider-aws-1.33-ecr-credential-provider | 0 | 1.33.2-r4 |
| Chainguard | cloud-provider-aws-1.34-cloud-controller-manager | 0 | 1.34.1-r4 |
| Chainguard | cloud-provider-aws-fips-1.28-ecr-credential-provider | 0 | 1.28.11-r13 |
| Chainguard | cloud-provider-aws-fips-1.29-cloud-controller-manager | 0 | 1.29.10-r3 |
| Chainguard | cloud-provider-aws-fips-1.29-ecr-credential-provider | 0 | 1.29.10-r3 |
| Chainguard | cloud-provider-aws-fips-1.31-cloud-controller-manager | 0 | 1.31.9-r3 |
| Chainguard | cloud-provider-aws-fips-1.31-ecr-credential-provider | 0 | 1.31.9-r3 |
| Chainguard | cloud-provider-aws-fips-1.32-cloud-controller-manager | 0 | 1.32.5-r3 |
| Chainguard | cloud-provider-aws-fips-1.32-ecr-credential-provider | 0 | 1.32.5-r3 |
| Chainguard | cloud-provider-aws-fips-1.33-cloud-controller-manager | 0 | 1.33.2-r3 |
| Chainguard | cloud-provider-aws-fips-1.33-ecr-credential-provider | 0 | 1.33.2-r3 |
| Chainguard | cloud-provider-aws-fips-1.34-cloud-controller-manager | 0 | 1.34.1-r4 |
| Chainguard | cloud-provider-aws-fips-1.34-ecr-credential-provider | 0 | 1.34.1-r4 |
| Chainguard | cloud-provider-azure-cloud-controller-manager-1.31 | 0 | 1.31.12-r3 |
| Chainguard | cloud-provider-azure-cloud-controller-manager-1.32 | 0 | 1.32.11-r2 |
| Chainguard | cloud-provider-azure-cloud-controller-manager-1.33 | 0 | 1.33.6-r2 |
| Chainguard | cloud-provider-azure-cloud-controller-manager-1.34 | 0 | 1.34.3-r3 |
| Chainguard | cloud-provider-azure-cloud-controller-manager-fips-1.27 | 0 | 1.27.21-r17 |
| Chainguard | cloud-provider-azure-cloud-controller-manager-fips-1.28 | 0 | 1.28.14-r13 |
| Chainguard | cloud-provider-azure-cloud-controller-manager-fips-1.29 | 0 | 1.29.15-r7 |
| Chainguard | cloud-provider-azure-cloud-controller-manager-fips-1.30 | 0 | 1.30.15-r4 |
| Chainguard | cloud-provider-azure-cloud-controller-manager-fips-1.31 | 0 | 1.31.12-r3 |
| Chainguard | cloud-provider-azure-cloud-controller-manager-fips-1.34 | 0 | 1.34.3-r3 |
Related vulnerabilities
- CVE-2025-61732 A discrepancy between how Go and C/C++ comments were parsed allowed for code smuggling… Also affects toolchain
- CVE-2025-61731 Building a malicious file with cmd/go can cause can cause a write to an… Also affects toolchain
- CVE-2023-24531 Command go env is documented as outputting a shell script containing the Go environment. Also affects toolchain
- CVE-2025-61726 The net/url package does not set a limit on the number of query parameters in a query. Also affects golang
- CVE-2025-61728 archive/zip uses a super-linear file name indexing algorithm that is invoked the first… Also affects golang
- CVE-2025-61730 During the TLS 1.3 handshake if multiple messages are sent in records that span… Also affects golang
- CVE-2025-61727 An excluded subdomain constraint in a certificate chain does not restrict the usage of… Also affects golang
- CVE-2025-61729 Within HostnameError.Error(), when constructing an error string, there is no limit to the… Also affects golang