CVE-2025-61731

EPSS 0.53%
Veröffentlicht 28.01.2026 19:30:30
Zuletzt bearbeitet 09.07.2026 13:16:42
Quelle security@golang.org
CVE-Watchlists
Login
Unerledigt
Login

Arbitrary file write using cgo pkg-config directive in cmd/go

Building a malicious file with cmd/go can cause can cause a write to an attacker-controlled file with partial control of the file content. The "#cgo pkg-config:" directive in a Go source file provides command-line arguments to provide to the Go pkg-config command. An attacker can provide a "--log-file" argument to this directive, causing pkg-config to write to an attacker-controlled location.

Betroffene Produkte Warnungen 0 Metriken 3 CWE 1 Referenzen 41

NVD 2 VulnDex Vulnerability Enrichment 0

Daten sind bereitgestellt durch National Vulnerability Database (NVD)

Golang ≫ Go Version < 1.24.12

Golang ≫ Go Version >= 1.25.0 < 1.25.6

Zu dieser CVE wurde keine Warnung gefunden.

EPSS Metriken
Typ	Quelle	Score	Percentile
EPSS	FIRST.org	0.53%	0.408

CVSS Metriken
Quelle	Base Score	Exploit Score	Impact Score	Vector String
134c704f-9b21-4f2e-91b3-4a467353bcc0	7.8	1.8	5.9	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
0b0ca135-0b70-47e7-9f44-1890c2a1c46c	8.6	1.8	6	CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

CWE-88 Improper Neutralization of Argument Delimiters in a Command ('Argument Injection')

The product constructs a string for a command to be executed by a separate component in another control sphere, but it does not properly delimit the intended arguments, options, or switches within that command string.

https://go.dev/cl/736711

Patch

https://go.dev/issue/77100

Issue Tracking

https://bugzilla.redhat.com/show_bug.cgi?id=2434433

https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-61731.json

https://groups.google.com/g/golang-announce/c/Vd2tYVM8eUc

Mailing List

Release Notes

https://access.redhat.com/errata/RHSA-2026:12282

https://access.redhat.com/errata/RHSA-2026:14100

https://access.redhat.com/errata/RHSA-2026:14774

https://access.redhat.com/errata/RHSA-2026:15091

https://access.redhat.com/errata/RHSA-2026:17598

https://access.redhat.com/errata/RHSA-2026:21691

https://access.redhat.com/errata/RHSA-2026:3556

https://access.redhat.com/errata/RHSA-2026:3559

https://access.redhat.com/errata/RHSA-2026:3855

https://access.redhat.com/errata/RHSA-2026:4434

https://access.redhat.com/errata/RHSA-2026:5948

https://access.redhat.com/errata/RHSA-2026:5950

https://access.redhat.com/errata/RHSA-2026:5952

https://access.redhat.com/errata/RHSA-2026:7291

https://access.redhat.com/errata/RHSA-2026:7385

https://access.redhat.com/errata/RHSA-2026:20088

https://access.redhat.com/errata/RHSA-2026:5941

https://access.redhat.com/errata/RHSA-2026:5942

https://access.redhat.com/errata/RHSA-2026:5943

https://access.redhat.com/errata/RHSA-2026:5944

https://access.redhat.com/errata/RHSA-2026:6949

https://access.redhat.com/errata/RHSA-2026:7833

https://access.redhat.com/errata/RHSA-2026:7834

https://access.redhat.com/errata/RHSA-2026:7876

https://access.redhat.com/errata/RHSA-2026:7877

https://access.redhat.com/errata/RHSA-2026:7878

https://access.redhat.com/errata/RHSA-2026:7879

https://access.redhat.com/errata/RHSA-2026:7883

https://pkg.go.dev/vuln/GO-2026-4339

Vendor Advisory

https://access.redhat.com/errata/RHSA-2026:12118

https://access.redhat.com/errata/RHSA-2026:13736

https://access.redhat.com/security/cve/CVE-2025-61731

https://access.redhat.com/errata/RHSA-2026:8448

https://nvd.nist.gov/vuln/detail/CVE-2025-61731

CVE Source (NVD)

https://cveawg.mitre.org/api/cve/CVE-2025-61731

CVE Source (JSON)

https://euvd.enisa.europa.eu/vulnerability/CVE-2025-61731

EUVD

Team-orientierte Vulnerability Management Plattform

Features der Plattform

CVE-2025-61731