CVE-2022-30580

Empty Cmd.Path can trigger unintended binary in os/exec on Windows

Description

Code injection in Cmd.Start in os/exec before Go 1.17.11 and Go 1.18.3 allows execution of any binaries in the working directory named either "..com" or "..exe" by calling Cmd.Run, Cmd.Start, Cmd.Output, or Cmd.CombinedOutput when Cmd.Path is unset.

Category

7.8
CVSS
Severity: High
CVSS 3.1 •
EPSS 0.02%
Vendor Advisory go.dev Vendor Advisory googlesource.com Vendor Advisory go.dev
Affected: Go standard library os/exec
Published at:
Updated at:

References

Link Tags
https://go.dev/cl/403759 vendor advisory
https://go.googlesource.com/go/+/960ffa98ce73ef2c2060c84c7ac28d37a83f345e vendor advisory patch mailing list
https://go.dev/issue/52574 issue tracking third party advisory
https://groups.google.com/g/golang-announce/c/TzIC9-t8Ytg/m/IWz5T6x7AAAJ mailing list third party advisory
https://pkg.go.dev/vuln/GO-2022-0532 vendor advisory

Frequently Asked Questions

What is the severity of CVE-2022-30580?
CVE-2022-30580 has been scored as a high severity vulnerability.
How to fix CVE-2022-30580?
To fix CVE-2022-30580, make sure you are using an up-to-date version of the affected component(s) by checking the vendor release notes. As for now, there are no other specific guidelines available.
Is CVE-2022-30580 being actively exploited in the wild?
As for now, there are no information to confirm that CVE-2022-30580 is being actively exploited. According to its EPSS score, there is a ~0% probability that this vulnerability will be exploited by malicious actors in the next 30 days.
What software or system is affected by CVE-2022-30580?
CVE-2022-30580 affects Go standard library os/exec.
This platform uses data from the NIST NVD, MITRE CVE, MITRE CWE, First.org and CISA KEV but is not endorsed or certified by these entities. CVE is a registred trademark of the MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. CWE is a registred trademark of the MITRE Corporation and the authoritative source of CWE content is MITRE's CWE web site.
© 2025 Under My Watch. All Rights Reserved.