关键信息 漏洞标题 漏洞编号 CVE-2025-68119 漏洞描述 The Go toolchain supports multiple VCS which are used for retrieving modules and embedding build information into binaries. On systems with Mercurial installed (hg) downloading modules (e.g. via go get or go mod download) from non-standard sources (e.g. custom domains) can cause unexpected code execution due to how external VCS commands are constructed. This issue can also be triggered by providing a malicious version string to the toolchain. 影响范围 Systems with Mercurial installed downloading modules from non-standard sources. Systems with Git installed using malicious version strings to download and build modules. 修复措施 The toolchain now uses safer VCS options to prevent misinterpretation of untrusted inputs. The toolchain now disallows module version strings prefixed with a "`` or )" character. 相关链接 公开Go issue: https://go.dev/issue/77099 内部跟踪和修复: http://b/467040974 和 https://go-internal-review.git.corp.google.com/c/go/+/3260 时间线 Issue创建时间: 3周前 Issue关闭时间: 2周前