{"record":{"id":"2209b08d333d55b2","repo":"golang/go","slug":"multiple-vcs-detected-s-in-q-and-s-in-q","errorCode":null,"errorMessage":"multiple VCS detected: %s in %q, and %s in %q","messagePattern":"multiple VCS detected: (.+?) in %q, and (.+?) in %q","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"src/cmd/go/internal/vcs/vcs.go","lineNumber":522,"sourceCode":"\t\t\t\t\tvcsCmd = vcs\n\t\t\t\t\trepoDir = dir\n\t\t\t\t\tif allowmultiplevcs.Value() == \"1\" {\n\t\t\t\t\t\tallowmultiplevcs.IncNonDefault()\n\t\t\t\t\t\treturn repoDir, vcsCmd, nil\n\t\t\t\t\t}\n\t\t\t\t\t// If allowmultiplevcs is not set, keep looking for\n\t\t\t\t\t// repositories in current and parent directories and report\n\t\t\t\t\t// an error if one is found to mitigate VCS injection\n\t\t\t\t\t// attacks.\n\t\t\t\t\tcontinue\n\t\t\t\t}\n\t\t\t\tif vcsCmd == vcsGit && vcs == vcsGit {\n\t\t\t\t\t// Nested Git is allowed, as this is how things like\n\t\t\t\t\t// submodules work. Git explicitly protects against\n\t\t\t\t\t// injection against itself.\n\t\t\t\t\tcontinue\n\t\t\t\t}\n\t\t\t\treturn \"\", nil, fmt.Errorf(\"multiple VCS detected: %s in %q, and %s in %q\",\n\t\t\t\t\tvcsCmd.Cmd, repoDir, vcs.Cmd, dir)\n\t\t\t}\n\t\t}\n\n\t\t// Move to parent.\n\t\tndir := filepath.Dir(dir)\n\t\tif len(ndir) >= len(dir) {\n\t\t\tbreak\n\t\t}\n\t\tdir = ndir\n\t}\n\tif vcsCmd == nil {\n\t\treturn \"\", nil, &vcsNotFoundError{dir: origDir}\n\t}\n\treturn repoDir, vcsCmd, nil\n}\n\n// isVCSRootDir reports whether dir is a VCS root according to roots.","sourceCodeStart":504,"sourceCodeEnd":540,"githubUrl":"https://github.com/golang/go/blob/b6b368adc57c96c3151d224d172029f233ead2c3/src/cmd/go/internal/vcs/vcs.go#L504-L540","documentation":"As a security mitigation against VCS injection attacks, FromDir stops if it encounters two different VCS root types in the directory hierarchy (e.g., a .svn directory inside a .git working copy). The only exceptions are nested Git (submodules) and the experimental GODEBUG=allowmultiplevcs=1 flag.","triggerScenarios":"A package directory tree contains VCS metadata from two different systems — e.g., `.hg` inside a `.git` repo, or `.svn` alongside `.git`. Also triggered by a malicious package planting a foreign VCS metadata directory to redirect fetching.","commonSituations":"Converting a repo from one VCS to another without cleaning up old metadata; nested checkouts from different VCS systems; supply-chain attack where a dependency includes a planted .hg/.svn directory.","solutions":["Remove the extraneous VCS metadata directory (e.g., `rm -rf .svn` if you're actually using git)","If nested repos are legitimate and non-Git, set GODEBUG=allowmultiplevcs=1 (understand the security risk first)","Audit the dependency tree for planted VCS directories if this is unexpected","Re-clone the repository cleanly from a single VCS"],"exampleFix":"# before: both .git and .svn present\ngo build ./...  # multiple VCS detected\n\n# after: remove the unwanted VCS metadata\nrm -rf .svn\ngo build ./...","handlingStrategy":"validation","validationCode":"# Check for multiple VCS metadata directories before building\nVCS_DIRS=\"$(find . -maxdepth 2 \\( -name .git -o -name .hg -o -name .svn -o -name .bzr -o -name .fslckout \\) -print 2>/dev/null | sort -u)\"\nCOUNT=$(echo \"$VCS_DIRS\" | grep -c . || true)\nif [ \"$COUNT\" -gt 1 ]; then\n  echo \"WARNING: multiple VCS directories found:\"\n  echo \"$VCS_DIRS\"\n  echo 'Remove extraneous VCS metadata to avoid injection detection'\nfi","typeGuard":null,"tryCatchPattern":"# Detect multiple VCS error and report\nERR=$(go build ./... 2>&1)\nif echo \"$ERR\" | grep -q 'multiple VCS detected'; then\n  echo 'Multiple VCS metadata dirs found — remove the unwanted one'\n  echo 'Or set GODEBUG=allowmultiplevcs=1 if you understand the risk'\nfi","preventionTips":["Clean up old VCS metadata when migrating between systems","Audit dependencies for planted VCS directories (supply-chain hygiene)","Use a fresh single-VCS clone for builds"],"tags":["vcs","security","injection","supply-chain"],"backgroundTag":null,"analyzedSha":"b6b368adc57c96c3151d224d172029f233ead2c3","analyzedAt":"2026-08-12T00:22:02.250Z","schemaVersion":2},"datasetVersion":"2026-08-12T13:17:24.610Z"}