VULNERABILITY INTELLIGENCE

CVE-2025-61731

CVSS score7.8 HIGH
EPSS probability0.61%
CISA KEVNot currently listed
Published2026-01-28
Last modified2026-09-10
CVSS vectorCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Description

Building a malicious file with cmd/go can cause can cause a write to an attacker-controlled file with partial control of the file content. The "#cgo pkg-config:" directive in a Go source file provides command-line arguments to provide to the Go pkg-config command. An attacker can provide a "--log-file" argument to this directive, causing pkg-config to write to an attacker-controlled location.

Weakness classification

  • nvd@nist.gov: NVD-CWE-noinfo
  • 0b0ca135-0b70-47e7-9f44-1890c2a1c46c: CWE-88

Primary references