« Volver al listado

CVE-2025-68120

Estado: AnalizadaMedia (5.4)—

To prevent unexpected untrusted code execution, the Visual Studio Code Go extension is now disabled in Restricted Mode.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

GO — GO

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2025-68120",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2025-68120",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2025-12-30T16:04:39.480671Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 5.4,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:L",
          "integrityImpact": "NONE",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "LOW",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "LOW"
        },
        "impactScore": 2.5,
        "exploitabilityScore": 2.8
      }
    ]
  },
  "affected": [
    {
      "source": "security@golang.org",
      "affectedData": [
        {
          "vendor": "github.com/golang/vscode-go",
          "product": "github.com/golang/vscode-go",
          "versions": [
            {
              "status": "affected",
              "version": "0",
              "lessThan": "0.52.1",
              "versionType": "semver"
            }
          ],
          "packageName": "github.com/golang/vscode-go",
          "collectionURL": "https://pkg.go.dev",
          "defaultStatus": "unaffected"
        }
      ]
    }
  ],
  "published": "2025-12-30T00:15:52.333",
  "references": [
    {
      "url": "https://groups.google.com/g/golang-dev/c/CHG4qfcicBU/m/4tanFUymDQAJ",
      "tags": [
        "Mailing List"
      ],
      "source": "security@golang.org"
    },
    {
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-68120",
      "tags": [
        "Third Party Advisory"
      ],
      "source": "security@golang.org"
    },
    {
      "url": "https://pkg.go.dev/vuln/GO-2025-4249",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "security@golang.org"
    }
  ],
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "NVD-CWE-noinfo"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "To prevent unexpected untrusted code execution, the Visual Studio Code Go extension is now disabled in Restricted Mode."
    },
    {
      "lang": "es",
      "value": "Para prevenir la ejecución inesperada de código no confiable, la extensión de Go de Visual Studio Code ahora está deshabilitada en Modo Restringido."
    }
  ],
  "lastModified": "2026-10-01T16:10:00.257",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:go:go:*:*:*:*:*:visual_studio_code:*:*",
              "vulnerable": true,
              "matchCriteriaId": "E55DE38E-7244-4EF6-B2D4-4035ADE3023C",
              "versionEndExcluding": "0.52.1"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "security@golang.org"
}