In short
- CVE-2022-30580 is a HIGH (CVSS 7.8) vulnerability affecting stdlib, go (golang).
- Chance of exploitation in the next 30 days (EPSS): 0.70%, higher than 53.2% of all vulnerabilities.
- Fix: update to 1.18.3, 1.17.11 or later.
| Package | Affected versions | Patched versions |
|---|
| stdlib Go | ≥ 1.18.0-0, < 1.18.3< 1.17.11
| 1.18.31.17.11
|
| go | ≥ 1.18.0, < 1.18.3< 1.17.11
| 1.18.31.17.11
|
Description
On Windows, executing Cmd.Run, Cmd.Start, Cmd.Output, or Cmd.CombinedOutput when Cmd.Path is unset will unintentionally trigger execution of any binaries in the working directory named either "..com" or "..exe".
NVD description
Code injection in Cmd.Start in os/exec before Go 1.17.11 and Go 1.18.3 allows execution of any binaries in the working directory named either "..com" or "..exe" by calling Cmd.Run, Cmd.Start, Cmd.Output, or Cmd.CombinedOutput when Cmd.Path is unset.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free