Unexpected paths returned from LookPath in os/exec
Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).
| Vendor | Product | Default status | Versions | |||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|
| Go standard library | os/exec | unaffected |
|
No data.
| Vendor | Product | Versions |
|---|---|---|
| Golang | Lookpath | — |
| Source | ID | Title |
|---|---|---|
EUVD |
EUVD-2025-30195 | If the PATH environment variable contains paths which are executables (rather than just directories), passing certain strings to LookPath ("", ".", and ".."), can result in the binaries listed in the PATH being unexpectedly returned. |
No CVSS v4.0
No CVSS v3.0
No CVSS v2
This CVE is not in the KEV list.
Exploit prediction score: < 1% (0.550% probability within 30 days)
| Type | Values Removed | Values Added |
|---|---|---|
| First Time appeared |
Golang go
|
|
| Weaknesses | NVD-CWE-Other | |
| CPEs | cpe:2.3:a:golang:go:*:*:*:*:*:*:*:* | |
| Vendors & Products |
Golang go
|
| Type | Values Removed | Values Added |
|---|---|---|
| References |
|
| Type | Values Removed | Values Added |
|---|---|---|
| Weaknesses | CWE-440 | |
| References |
| |
| Metrics |
threat_severity
|
threat_severity
|
| Type | Values Removed | Values Added |
|---|---|---|
| First Time appeared |
Golang
Golang lookpath |
|
| Vendors & Products |
Golang
Golang lookpath |
| Type | Values Removed | Values Added |
|---|---|---|
| Metrics |
cvssV3_1
|
| Type | Values Removed | Values Added |
|---|---|---|
| Description | If the PATH environment variable contains paths which are executables (rather than just directories), passing certain strings to LookPath ("", ".", and ".."), can result in the binaries listed in the PATH being unexpectedly returned. | |
| Title | Unexpected paths returned from LookPath in os/exec | |
| References |
|
View source · Bugzilla · JSON
OpenCVE enrichment
Updated: Sep 19, 2025, 9:35 AM
EUVD