CVE-2025-47906

Unexpected paths returned from LookPath in os/exec

State: Published
Severity: 6.5 Medium
Published: Sep 18, 2025
Updated: Nov 4, 2025
Reserved: May 13, 2025

Description

If the PATH environment variable contains paths which are executables (rather than just directories), passing certain strings to LookPath ("", ".", and ".."), can result in the binaries listed in the PATH being unexpectedly returned.

Scores

CVSS	Score	Vector	Source
3.1	6.5 Medium	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L	CISA-ADP

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
os/execGo standard library	before 1.23.12Affected 1.24.0 to before 1.24.6Affected

References

https://go.dev/cl/691775
https://go.dev/issue/74466
https://groups.google.com/g/golang-announce/c/x5MKroML2yM
https://pkg.go.dev/vuln/GO-2025-3956
http://www.openwall.com/lists/oss-security/2025/08/06/1

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.