CVE-2025-68120: Visual Studio Code Go extension has unexpected untrusted code execution

December 30, 2025 (updated December 31, 2025)

To prevent unexpected untrusted code execution, the Visual Studio Code Go extension is now disabled in Restricted Mode.

References

github.com/advisories/GHSA-fjmr-7667-8v4p
github.com/golang/vscode-go
groups.google.com/g/golang-dev/c/CHG4qfcicBU/m/4tanFUymDQAJ
nvd.nist.gov/vuln/detail/CVE-2025-68120
pkg.go.dev/vuln/GO-2025-4249

Code Behaviors & Features

Detect and mitigate CVE-2025-68120 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →