CVE-2025-68120 Unexpected untrusted code execution in github.com/golang/vscode-go
The VS Code Go extension allowed untrusted code execution, which is now prevented by disabling the extension in Restricted Mode.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2025-68120?
CVE-2025-68120 is a medium-severity code injection vulnerability in github.com/golang/vscode-go, published on 29 Dec 2025. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
To prevent unexpected untrusted code execution, the Visual Studio Code Go extension is now disabled in Restricted Mode.
Which versions are affected by CVE-2025-68120?
3 open source packages ship an affected version, including github.com/golang/vscode-go. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
github.com/golang/vscode-go Go | All versions | 0.52.1 |
github.com/golang/vscode-go Go | All versions | 0.52.1 |
github.com/golang/vscode-go Go | All versions | 0.52.1 |
Products include Go Go.
How do I fix CVE-2025-68120?
Upgrade github.com/golang/vscode-go to 0.52.1 or later.
Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.
Is CVE-2025-68120 being exploited?
There is no known exploitation of CVE-2025-68120 in the wild and no public exploit code.
Sources
Also known as GHSA-fjmr-7667-8v4p, GO-2025-4249.