A vulnerability in the Go toolchain allows local attackers to achieve code execution or arbitrary file writes by providing malicious version strings during module operations.

This is an OS command injection flaw (CWE-78) triggered by the improper neutralization of special elements when the toolchain invokes external version control systems like Mercurial or Git. The vulnerability requires an attacker to provide a malicious version string during the module download or build process.

Successful exploitation of this flaw allows an attacker with local access to the development environment to execute arbitrary code or write to files on the filesystem. Given the CVSS score of 7.0, this represents a high risk to the integrity and availability of build systems and developer workstations. Compromise of these systems can lead to the injection of malicious code into software supply chains.

Immediate Action: Update the Go toolchain to version 1.25.6 or later to incorporate the security patches provided by the vendor.

Proactive Monitoring: Audit build logs and developer workflows for the use of non-standard module sources or suspicious version strings that deviate from established naming conventions.

Compensating Controls: Restrict the installation of unnecessary version control systems on build servers and enforce strict permission controls on the filesystem to minimize the impact of potential arbitrary file writes.

Public Exploit Available: Unknown

This vulnerability presents a significant risk to the integrity of software development environments. Organizations should prioritize upgrading their Go toolchain installations to version 1.25.6 immediately. Failure to patch may allow attackers to compromise build pipelines and introduce malicious artifacts into the software development lifecycle.