Description (CNA)
If the PATH environment variable contains paths which are executables (rather than just directories), passing certain strings to LookPath ("", ".", and ".."), can result in the binaries listed in the PATH being unexpectedly returned.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| Go standard library / os/exec | affected 0 before 1.23.12; affected 1.24.0 before 1.24.6 |
CWE
No CWE identifiers supplied.
References
- https://go.dev/cl/691775
- https://go.dev/issue/74466
- https://groups.google.com/g/golang-announce/c/x5MKroML2yM
- https://pkg.go.dev/vuln/GO-2025-3956
ADP enrichment
No English description supplied.
No references supplied.
No English description supplied.