Skip to content
Sign in
7.8 High

CVE-2022-30580 Code injection in Cmd.Start in os/exec before Go 1.17.11 and Go 1.18.3 allows execution of any binaries in the working…

Description

Code injection in Cmd.Start in os/exec before Go 1.17.11 and Go 1.18.3 allows execution of any binaries in the working directory named either "..com" or "..exe" by calling Cmd.Run, Cmd.Start, Cmd.Output, or Cmd.CombinedOutput when Cmd.Path is unset.

Affected products and versions

Product Affected versions Fixed in
os/exec 1.18 1.18.0-0 → < 1.18.3 1.18.3
os/exec 1.17 earliest → < 1.17.11 1.17.11

Other CVEs of os/exec

The 3 CVEs of os/exec →
CVE-2025-47906 If the PATH environment variable contains paths which are executables (rather than just directories), passing certain… 6.5 Medium CVE-2022-41716 Due to unsanitized NUL values, attackers may be able to maliciously set environment variables on Windows 6.3 Medium
Track this CVE