CVE-2025-68120
📋 TL;DR
The Visual Studio Code Go extension contains a vulnerability that could allow untrusted code execution when opening projects in Restricted Mode. This affects developers using VS Code with the Go extension installed. The vulnerability has been addressed by disabling the extension in Restricted Mode by default.
💻 Affected Systems
- Visual Studio Code Go extension
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Remote code execution when opening malicious Go projects in VS Code Restricted Mode, potentially compromising the developer's system.
Likely Case
Limited impact since Restricted Mode is designed to prevent untrusted code execution, but the vulnerability bypasses some of these protections.
If Mitigated
Minimal impact if the Go extension is disabled in Restricted Mode or if users avoid opening untrusted projects.
🎯 Exploit Status
Exploitation requires user interaction (opening a malicious project in Restricted Mode).
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Latest version of VS Code Go extension
Vendor Advisory: https://pkg.go.dev/vuln/GO-2025-4249
Restart Required: Yes
Instructions:
1. Update Visual Studio Code to latest version. 2. Update Go extension to latest version. 3. Restart VS Code.
🔧 Temporary Workarounds
Disable Go extension in Restricted Mode
allManually disable the Go extension when working in Restricted Mode
In VS Code: Ctrl+Shift+P > 'Developer: Show Running Extensions' > Disable Go extension
Avoid Restricted Mode for Go projects
allOnly open trusted Go projects or disable Restricted Mode for Go development
🧯 If You Can't Patch
- Disable the Go extension entirely in VS Code settings
- Use alternative Go development environments for untrusted projects
🔍 How to Verify
Check if Vulnerable:
Check if Go extension is enabled in VS Code Restricted Mode settingsCheck Version:
In VS Code: Ctrl+Shift+P > 'Extensions: Show Installed Extensions' > Find Go extensionVerify Fix Applied:
Verify Go extension is disabled in Restricted Mode or check extension version is latest📡 Detection & Monitoring
Log Indicators:
- VS Code extension activation logs showing Go extension in Restricted Mode
- Unexpected process execution from Go tools
Network Indicators:
- Unusual outbound connections from VS Code process during Go project analysis
SIEM Query:
process.name:vscode AND process.cmdline:*go* AND event.action:execute