CVE-2025-68119

score

<0.1

cvss

7.0

epss

0.4%

published

2026-01-28

kev added

—

first seen

2026-10-21

Go toolchain contains command injection caused by malicious version strings in module downloads, letting attackers execute code locally or write arbitrary files, exploit requires explicit malicious version string input.