Vulnerability · Published Aug 9, 2022 · Assigned by Go
CVE-2022-30580Empty Cmd.Path can trigger unintended binary in os/exec on Windows
High 7.8
In plain English
A high-severity code injection in os/exec from Go standard library. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.7% (higher than 53% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Severity (CVSS 3.1)7.8High
Exploit odds (30 days)0.7%top 46.6% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
Code injection in Cmd.Start in os/exec before Go 1.17.11 and Go 1.18.3 allows execution of any binaries in the working directory named either "..com" or "..exe" by calling Cmd.Run, Cmd.Start, Cmd.Output, or Cmd.CombinedOutput when Cmd.Path is unset.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Go | stdlib | 1.17.11, 1.18.3 | GO-2022-0532 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Go standard library | os/exec | 0 – before 1.17.111.18.0-0 – before 1.18.3 |
Weakness: CWE-94 · Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H