The Go toolchain supports multiple VCS which are used retrieving modules and
embedding build information into binaries.

On systems with Mercurial installed (hg) downloading modules (e.g. via go get or
go mod download) from non-standard sources (e.g. custom domains) can cause
unexpected code execution due to how external VCS commands are constructed.
This issue can also be triggered by providing a malicious version string to
the toolchain.

On systems with Git installed, downloading and building modules with malicious
version strings could allow an attacker to write to arbitrary files on the
system the user has access to. This can only be triggered by explicitly
providing the malicious version strings to the toolchain, and does not affect
usage of @latest or bare module paths.

The toolchain now uses safer VCS options to prevent misinterpretation of
untrusted inputs. In addition, the toolchain now disallows module version
strings prefixed with a "-" or "/" character.

Thanks to splitline (@splitline) from DEVCORE Research Team for reporting this
issue.

This is CVE-2025-68119 and Go issue https://go.dev/issue/77099.

This is a PRIVATE issue for CVE-2025-68119, tracked in http://b/467040974 and fixed by https://go-internal-review.git.corp.google.com/c/go/+/3260.

/cc @golang/security and @golang/release