BIT-golang-2025-47906

vendorUSosv

Unexpected paths returned from LookPath in os/exec

Advisory ansehen veröffentlicht 2025-09-20Lizenz: per source

If the PATH environment variable contains paths which are executables (rather than just directories), passing certain strings to LookPath ("", ".", and ".."), can result in the binaries listed in the PATH being unexpectedly returned.

beschreibt (1)

Zugehörige CVEs.

ID	Schweregrad	EPSS	ausnutzbar	veröffentlicht
CVE-2025-47906US	—	0.55% (45th)	—	2025-09-18
If the PATH environment variable contains paths which are executables (rather than just directories), passing certain strings to LookPath ("", ".", and ".."), can result in the bin…

Referenzen

Externe Belege — Patches, Meldungen, Analysen.

http://www.openwall.com/lists/oss-security/2025/08/06/1REPORT
https://go.dev/cl/691775FIX
https://go.dev/issue/74466ADVISORY
https://groups.google.com/g/golang-announce/c/x5MKroML2yMDISCUSSION
https://nvd.nist.gov/vuln/detail/CVE-2025-47906WEB
https://pkg.go.dev/vuln/GO-2025-3956ADVISORY

scry

Advisories wie diese benennen die exponierten Produkte, die Angreifer auf Ihrer Angriffsfläche ins Visier nehmen. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.

Kostenloser Scan