CVE-2025-4674 is a high-severity vulnerability in the go command where it may execute unexpected commands when operating in untrusted version control system (VCS) repositories. This occurs if a repository fetched by one VCS contains metadata for another VCS, potentially leading to command execution. Modules retrieved via "go get" are not affected.