NotCVE-2025-0004

The Go standard library function os.RemoveAll prior to Go 1.21.11 and 1.22.4 performs recursive directory deletion in a manner susceptible to a time-of-check/time-of-use (TOCTOU) race. An attacker able to swap the target directory with a symbolic link during deletion may redirect the traversal to unintended filesystem locations, allowing deletion of arbitrary files or directories. This behavior impacts any Go programs that perform recursive deletes on user-controlled paths without additional safeguards.

Although upstream considers this a hardening fix, this behavior has clear and reproducible security consequences. Assigning a NotCVE helps downstream users understand and mitigate the risk across all Go-based applications, not just Kubernetes.