Due to #71469, a toolchain directive with a ADS suffix (e.g. toolchain go1.25-:alt), can result in the toolchain attempting to execute a files alternate data stream that is located alongside the go.mod file.
Since it's somewhat complex to create a file with ADS, and as far as we could tell no source control software supports it, while clearly unexpected, we do not consider this significantly dangerous.
This is a PUBLIC track security issue per our security policy.
Thanks to Juho Forsén for reporting this issue.
Due to #71469, a toolchain directive with a ADS suffix (e.g.
toolchain go1.25-:alt), can result in the toolchain attempting to execute a files alternate data stream that is located alongside the go.mod file.Since it's somewhat complex to create a file with ADS, and as far as we could tell no source control software supports it, while clearly unexpected, we do not consider this significantly dangerous.
This is a PUBLIC track security issue per our security policy.
Thanks to Juho Forsén for reporting this issue.