CVE-2022-30580

7.8 HIGH

Published: August 10, 2022 Modified: March 06, 2026

Description

Code injection in Cmd.Start in os/exec before Go 1.17.11 and Go 1.18.3 allows execution of any binaries in the working directory named either "..com" or "..exe" by calling Cmd.Run, Cmd.Start, Cmd.Output, or Cmd.CombinedOutput when Cmd.Path is unset.

AI Explanation

Get an AI-powered plain-language explanation of this vulnerability and remediation steps.

CVSS v3.x Details

0.0 Low Medium High Critical 10.0

Vector String

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

References to Advisories, Solutions, and Tools

Patch Vendor Advisory Exploit Third Party Advisory

https://go.dev/cl/403759

Source: security@golang.org

Vendor Advisory

https://go.dev/issue/52574

Source: security@golang.org

Issue Tracking Third Party Advisory

https://go.googlesource.com/go/+/960ffa98ce73ef2c2060c84c7ac28d37a83f345e

Source: security@golang.org

Mailing List Patch Vendor Advisory

https://groups.google.com/g/golang-announce/c/TzIC9-t8Ytg/m/IWz5T6x7AAAJ

Source: security@golang.org

Mailing List Third Party Advisory

https://pkg.go.dev/vuln/GO-2022-0532

Source: security@golang.org

Vendor Advisory

https://go.dev/cl/403759