os/exec vulnerabilities

Latest os/exec CVEs

Newest publication first

1. CVE-2025-47906 Unexpected paths returned from LookPath in os/exec

   Published 2025-09-18

   Medium·CVSS 6.5

   If the PATH environment variable contains paths which are executables (rather than just directories), passing certain strings to LookPath ("", ".", and ".."), can result in the binaries listed in the PATH being unexpectedly returned.

2. CVE-2022-41716 Unsanitized NUL in environment variables on Windows in syscall and os/exec

   Published 2022-11-02

   High·CVSS 7.5

   Due to unsanitized NUL values, attackers may be able to maliciously set environment variables on Windows. In syscall.StartProcess and os/exec.Cmd, invalid environment variable values containing NUL values are not properly checked for. A malicious environment variable value can ex...

3. CVE-2022-30580 Empty Cmd.Path can trigger unintended binary in os/exec on Windows

   Published 2022-08-09

   High·CVSS 7.8

   Code injection in Cmd.Start in os/exec before Go 1.17.11 and Go 1.18.3 allows execution of any binaries in the working directory named either "..com" or "..exe" by calling Cmd.Run, Cmd.Start, Cmd.Output, or Cmd.CombinedOutput when Cmd.Path is unset.

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.