CVE-2025-61731
Golang Go ≤ 1.24.12
Raw vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HSummary
CVE-2025-61731 is a high-severity Argument Injection (CWE-88) vulnerability in Golang Go. Its CVSS base score is 7.8 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Command and Scripting Interpreter (T1059); ranked at the 42th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified map to SA-11 (Developer Testing and Evaluation) and SI-10 (Information Input Validation) — see the control section below for these in your framework.
Deeper analysis AI-assisted summary
Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.
CVE-2025-61731 affects the cmd/go tool in the Go programming language. The vulnerability arises when building a Go source file that includes a malicious "#cgo pkg-config:" directive. This directive passes command-line arguments to the pkg-config command, and an attacker can include a "--log-file" argument to direct pkg-config to write log data to an attacker-controlled file location, granting partial control over the written content.
A local attacker with low privileges can exploit this issue by tricking a user into building a malicious Go source file. Exploitation requires local access and low complexity with no user interaction needed. Successful attacks enable arbitrary file writes, resulting in high impacts to confidentiality, integrity, and availability, as reflected in the CVSS v3.1 base score of 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).
Go advisories detail mitigations and patches, including the fix in change list https://go.dev/cl/736711, issue discussion at https://go.dev/issue/77100, announcement at https://groups.google.com/g/golang-announce/c/Vd2tYVM8eUc, and vulnerability entry at https://pkg.go.dev/vuln/GO-2026-4339.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-206447
Vulnerability Data
Building a malicious file with cmd/go can cause can cause a write to an attacker-controlled file with partial control of the file content. The "#cgo pkg-config:" directive in a Go source file provides command-line arguments to provide to the Go…
more
pkg-config command. An attacker can provide a "--log-file" argument to this directive, causing pkg-config to write to an attacker-controlled location.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise Techniques
CVEs Like This One
Affected Assets
Mitigating Controls
Control response
—
—
—
V1.2.5
Mitigating Controls (NIST 800-53 r5) AI
Developer testing can discover argument-injection flaws in command-construction code but does not stop their introduction.
Input validation directly stops construction of command strings containing unneutralized delimiters or injected arguments.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Secure SDLC practices directly require proper input validation and command construction to prevent argument injection.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Security testing can detect argument injection but does not prevent it at the source.
Secure development lifecycle mandates input validation and command construction practices that directly prevent argument injection.
Application security requirements include explicit rules for safe command-line argument handling and escaping.
Secure architecture principles discourage unsafe command invocation patterns and favor safer APIs.
Secure coding standards explicitly require proper neutralization of command arguments, directly eliminating CWE-88.
Change management can catch unsafe command patterns during reviews but is not a direct mitigation.