Go package manager implements robust fix for critical Git argument injection flaw
While Go’s cmd/go tool adopts the --end-of-options flag to prevent arbitrary command execution, many competing package managers remain constrained by legacy operating system support.
Go’s cmd/go package manager has addressed CVE-2025-68119, a critical argument injection vulnerability within its Git integration. The flaw permitted untrusted repository URLs or references to be misinterpreted as Git options, potentially allowing attackers to execute arbitrary commands. The remediation involves implementing the --end-of-options flag, a feature originally introduced in Git version 2.24.0. While Go has adopted this robust workaround, many other package managers continue to rely on less secure methods, such as the -- separator, due to compatibility constraints with older Git versions found in legacy operating systems.
The vulnerability exploited how Git parses arguments starting with a dash. In most Unix tools, the double-dash marker signifies the end of option parsing. However, Git had repurposed -- early on to separate revisions from pathspecs, leaving the revision position without a terminator. Consequently, if a script passes a revision starting with a dash, Git parses it as an option rather than data. The --end-of-options flag provides a distinct marker to separate options from revisions, ensuring that subsequent arguments are treated strictly as data.
Go’s initial hardening in June 2019 used only -- before repository URLs, which proved insufficient against argument injection. The codebase was updated in January 2026 to include --end-of-options across the board as the fix for CVE-2025-68119. The patch also includes HGPLAIN=+strictflags to restrict Mercurial’s early-option parsing, addressing similar risks in other version control systems.
Among 19 package managers checked, only Go’s cmd/go uses --end-of-options by default. Others rely on -- or leading-dash rejection, often due to compatibility with older Git versions on legacy operating systems. For instance, Homebrew’s minimum Git version is 2.7.0 on Linux, while Ubuntu 20.04, in extended support until 2030, packages 2.25.1. Raising the minimum Git version to support --end-of-options for all subcommands, such as 2.43.1 for checkout and reset, would exclude users on these distributions.
Tools utilising in-process Git libraries, such as libgit2, gitoxide, go-git, JGit, and dulwich, generally avoid this specific argv boundary risk by bypassing the subprocess call. However, they face maintenance costs to track upstream safety fixes independently. go-git has one published CVE, CVE-2025-21613, specifically affecting the file:// transport, which is the only code path in go-git that spawns the Git binary.
