AZL-75728 CVE-2025-68119 affecting package golang for versions less than 1.25.6-1

Downloading and building modules with malicious version strings can cause local code execution. On systems with Mercurial hg installed, downloading modules from non-standard sources e.g., custom domains can cause unexpected code execution due to how external VCS commands are constructed. This iss...

Command Injection

Overview cocoapods-downloader is an A small library for downloading files from remotes in a folder. Affected versions of this package are vulnerable to Command Injection via hg argument injection. When calling the download function when using hg, the url and/or revision, tag, branch is passed to...