Go Standard Library Syscall vulnerabilities
2 vulnerabilities
Known vulnerabilities in Go Standard Library Syscall, newest first, with CVSS severity, EPSS, KEV listings, ransomware use and the affected versions.
RoutineCVE-2025-0913go standard library · os +48 moreInconsistent handling of O_CREATE|O_EXCL on Unix and Windows in os in syscallos.OpenFile(path, os.O_CREATE|O_EXCL) behaved differently on Unix and Windows systems when the target path was a dangling symlink. On Unix systems, OpenFile with O_CREATE and O_EXCL flags never follows symlinks. On Windows, when the target path was a symlink to a nonexistent location, OpenFile would create a file in that location. OpenFile now always returns an error when the O_CREATE and O_EXCL flags are both set and the target path is a symlink.CVSS5.5MediumEPSS0.33%RoutineCVE-2022-41716go standard library · os/exec +45 moreUnsanitized NUL in environment variables on Windows in syscall and os/execDue to unsanitized NUL values, attackers may be able to maliciously set environment variables on Windows. In syscall.StartProcess and os/exec.Cmd, invalid environment variable values containing NUL values are not properly checked for. A malicious environment variable value can exploit this behavior to set a value for a different environment variable. For example, the environment variable string "A=B\x00C=D" sets the variables "A=B" and "C=D".CVSS7.5HighEPSS1.03%