Go Standard Library Os/Exec vulnerabilities
3 vulnerabilities
Known vulnerabilities in Go Standard Library Os/Exec, newest first, with CVSS severity, EPSS, KEV listings, ransomware use and the affected versions.
RoutineCVE-2025-47906go standard library · os/exec +311 moreUnexpected paths returned from LookPath in os/execIf the PATH environment variable contains paths which are executables (rather than just directories), passing certain strings to LookPath ("", ".", and ".."), can result in the binaries listed in the PATH being unexpectedly returned.CVSS6.5MediumEPSS0.55%RoutineCVE-2022-41716go standard library · os/exec +45 moreUnsanitized NUL in environment variables on Windows in syscall and os/execDue to unsanitized NUL values, attackers may be able to maliciously set environment variables on Windows. In syscall.StartProcess and os/exec.Cmd, invalid environment variable values containing NUL values are not properly checked for. A malicious environment variable value can exploit this behavior to set a value for a different environment variable. For example, the environment variable string "A=B\x00C=D" sets the variables "A=B" and "C=D".CVSS7.5HighEPSS1.03%RoutineCVE-2022-30580go standard library · os/exec +3 moreEmpty Cmd.Path can trigger unintended binary in os/exec on WindowsCode injection in Cmd.Start in os/exec before Go 1.17.11 and Go 1.18.3 allows execution of any binaries in the working directory named either "..com" or "..exe" by calling Cmd.Run, Cmd.Start, Cmd.Output, or Cmd.CombinedOutput when Cmd.Path is unset.CVSS7.8HighEPSS0.70%