CVEvulnerability
CVE-2022-30580
7.8 HIGH
Official page ↗
- Status
- Modified
- Published
- 2022-08-10
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 3.1 ([email protected])
- 7.8 HIGH — CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- CVSS 3.1 (134c704f-9b21-4f2e-91b3-4a467353bcc0)
- 7.8 HIGH — CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- Weaknesses
- CWE-94
Description
Code injection in Cmd.Start in os/exec before Go 1.17.11 and Go 1.18.3 allows execution of any binaries in the working directory named either "..com" or "..exe" by calling Cmd.Run, Cmd.Start, Cmd.Output, or Cmd.CombinedOutput when Cmd.Path is unset.
Affected configurations
• golang go (< 1.17.11)
• golang go (>= 1.18.0 < 1.18.3)
Related
Weakness · CWE (1)
- CWE-94 Improper Control of Generation of Code weakness
References
- https://go.dev/cl/403759 Vendor Advisory
- https://go.dev/issue/52574 Issue Tracking, Third Party Advisory
- https://go.googlesource.com/go/+/960ffa98ce73ef2c2060c84c7ac28d37a83f345e Mailing List, Patch, Vendor Advisory
- https://groups.google.com/g/golang-announce/c/TzIC9-t8Ytg/m/IWz5T6x7AAAJ Mailing List, Third Party Advisory
- https://pkg.go.dev/vuln/GO-2022-0532 Vendor Advisory
- https://go.dev/cl/403759 Vendor Advisory
- https://go.dev/issue/52574 Issue Tracking, Third Party Advisory
- https://go.googlesource.com/go/+/960ffa98ce73ef2c2060c84c7ac28d37a83f345e Mailing List, Patch, Vendor Advisory
- https://groups.google.com/g/golang-announce/c/TzIC9-t8Ytg/m/IWz5T6x7AAAJ Mailing List, Third Party Advisory
- https://pkg.go.dev/vuln/GO-2022-0532 Vendor Advisory