CVE-2025-47906medium

CVE-2025-47906: medium-severity vulnerability in Go standard library os/exec

Unexpected paths returned from LookPath in os/exec

Published · Updated

Follow this CVE+ Monitor os/exec+ Monitor go

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

13Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 6.5epss 0.5%
If the PATH environment variable contains paths which are executables (rather than just directories), passing certain strings to LookPath ("", ".", and ".."), can result in the binaries listed in the PATH being unexpectedly returned.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L
Affected products
Go standard library · os/exec
Related CVEs — Go standard library os/exec

In the same product, most dangerous first.

CVE-2022-41716MEDIUMUnsanitized NUL in environment variables on Windows in syscall and os/execEPSS 1.0%CVE-2022-30580HIGHEmpty Cmd.Path can trigger unintended binary in os/exec on WindowsEPSS 0.7%