Various uses of the Go toolchain in untrusted VCS repositories can result in
unexpected code execution. When using the Go toolchain in directories fetched
using various VCS tools (such as directly cloning Git or Mercurial repositories)
can cause the toolchain to execute unexpected commands, if said directory
contains multiple VCS configuration metadata (such as a '.hg' directory in a Git
repository). This is due to how the Go toolchain attempts to resolve which VCS
is being used in order to embed build information in binaries and determine
module versions.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 / openSUSE 15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2025:02295-1 advisory.

    - Update to version go1.24.5
    - CVE-2025-4674: Fixed potential command execution in untrusted VCS repositories. (bsc#1246118)

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 / openSUSE 15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2025:02296-1 advisory.

    - Update to version go1.23.11
    - CVE-2025-4674: Fixed potential command execution in untrusted VCS repositories. (bsc#1246118)

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of Golang running on the remote host is 1.23.x prior to 1.23.11, 1.24.x prior to 1.24.3. It is, therefore, affected by a command execution vulnerability as referenced in 74380 advisory.

  - Various uses of the Go toolchain in untrusted VCS repositories can result in unexpected code execution.     When using the Go toolchain in directories fetched using various VCS tools (such as directly cloning Git     or Mercurial repositories) can cause the toolchain to execute unexpected commands, if said directory     contains multiple VCS configuration metadata (such as a '.hg' directory in a Git repository). This is due     to how the Go toolchain attempts to resolve which VCS is being used in order to embed build information     in binaries and determine module versions. (CVE-2025-4674)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
242015	SUSE SLED15 / SLES15 / openSUSE 15 Security Update : go1.24 (SUSE-SU-2025:02295-1)	Nessus	SuSE Local Security Checks	high
242012	SUSE SLED15 / SLES15 / openSUSE 15 Security Update : go1.23 (SUSE-SU-2025:02296-1)	Nessus	SuSE Local Security Checks	high
241710	Golang 1.23.x < 1.23.11 / 1.24.x < 1.24.5 Command Execution	Nessus	Misc.	high

Detections

Analytics

CVE-2025-4674

high

Tenable Plugins

high

high

high