Skip to content
fr Sign in
6.5 Medium

CVE-2025-47906 If the PATH environment variable contains paths which are executables (rather than just directories), passing certain…

Description

If the PATH environment variable contains paths which are executables (rather than just directories), passing certain strings to LookPath ("", ".", and ".."), can result in the binaries listed in the PATH being unexpectedly returned.

Affected products and versions

Product Affected versions Fixed in
os/exec 1.24 1.24.0 → < 1.24.6 1.24.6
os/exec 1.23 earliest → < 1.23.12 1.23.12

References

Timeline

  1. Published
  2. Last modified

Other CVEs of os/exec

The 3 CVEs of os/exec →
CVE-2022-41716 Due to unsanitized NUL values, attackers may be able to maliciously set environment variables on Windows 6.3 Medium CVE-2022-30580 Code injection in Cmd.Start in os/exec before Go 1.17.11 and Go 1.18.3 allows execution of any binaries in the working… 7.8 High
Track this CVE