CVE-2025-68120Medium· 5.4▾ SunlitTo prevent unexpected untrusted code execution, the Visual Studio Code Go extension is now disabled in Restricted Mode.
▾ Sunlit zone — Low / medium · no exploitation signal
impact 29.7 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
Last analysed / modified upstream
0.5%
To prevent unexpected untrusted code execution, the Visual Studio Code Go extension is now disabled in Restricted Mode.
go < 0.52.1Upgrade past the affected range:
go 0.52.1Connected by shared product, vendor, weakness, or advisory.
CVE-2025-58185Medium· 5.3Parsing a maliciously crafted DER payload could allocate large amounts of memory, causing memory exhaustion.
CVE-2025-47912Medium· 5.3The Parse function permits values other than IPv6 addresses to be included in square brackets within the host component of a URL
CVE-2026-32288Medium· 5.5tar.Reader can allocate an unbounded amount of memory when reading a maliciously-crafted archive containing a large number of sparse regions encoded in the "old GNU sparse map" format.
CVE-2026-27144High· 7.1The compiler is meant to unwrap pointers which are the operands of a memory move; a no-op interface conversion prevented the compiler from making the correct determination about non-overlapping moves, potentially leading to memory corrup…
CVE-2026-27143Critical· 9.8Arithmetic over induction variables in loops were not correctly checked for underflow or overflow
CVE-2026-27140High· 8.8SWIG file names containing 'cgo' and well-crafted payloads could lead to code smuggling and arbitrary code execution at build time due to trust layer bypass.