Read the docs
TI-2022-12726 Aliases CVE-2022-30580GHSA-2v97-2cxm-mvp4

Empty Cmd.Path can trigger unintended binary in os/exec on Windows

Priority LOW 37CWE-94Published · Updated

Key facts

Attack vector
Local
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA. Impact type from CWE-94.

Summary

Code injection in Cmd.Start in os/exec before Go 1.17.11 and Go 1.18.3 allows execution of any binaries in the working directory named either "..com" or "..exe" by calling Cmd.Run, Cmd.Start, Cmd.Output, or Cmd.CombinedOutput when Cmd.Path is unset.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00701 53rd percentileScored 2026-11-07
Fix Fixed os/exec (Go standard library): 1.17.11, 1.18.3

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
Go standard libraryos/execbefore 1.17.11; 1.18.0-0 to before 1.18.31.17.11, 1.18.3Patch availableCNA
  • os/exec VendorGo standard library Affected before 1.17.11; 1.18.0-0 to before 1.18.3 Fixed in 1.17.11, 1.18.3 Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:golang:go:*:*:*:*:*:*:*:*before 1.17.11; 1.18.0 to before 1.18.3VulnerableGo standard library
  • cpe:2.3:a:golang:go:*:*:*:*:*:*:*:* Versions before 1.17.11; 1.18.0 to before 1.18.3 Vulnerable ·Go standard library

Remediation

  • Fix · CNA os/exec (Go standard library) Fixed in 1.17.11, 1.18.3

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

Not affected: 35 products
  • Custom Metric Autoscaler operator for Red Hat Openshift
  • Logging Subsystem for Red Hat OpenShift
  • Migration Toolkit for Containers
  • Migration Toolkit for Virtualization
  • Node HealthCheck Operator
  • Node Maintenance Operator
  • OpenShift API for Data Protection
  • OpenShift Developer Tools and Services
  • OpenShift Pipelines
  • OpenShift Secondary Scheduler Operator
  • OpenShift Serverless
  • OpenShift Service Mesh 2
  • Red Hat 3scale API Management Platform 2
  • Red Hat Advanced Cluster Management for Kubernetes 2
  • Red Hat Advanced Cluster Security 3
  • Red Hat Ansible Automation Platform 2
  • Red Hat Application Interconnect 1.0
  • Red Hat Ceph Storage 3
  • Red Hat Ceph Storage 5
  • Red Hat Enterprise Linux 8
  • Red Hat Enterprise Linux 9
  • Red Hat OpenShift Container Platform 4
  • Red Hat OpenShift Dev Spaces
  • Red Hat OpenShift GitOps
  • Red Hat OpenShift Virtualization 4
  • Red Hat OpenShift distributed tracing 2
  • Red Hat OpenShift on AWS
  • Red Hat OpenStack Platform 16.2
  • Red Hat Openshift Data Foundation 4
  • Red Hat Openshift Sandboxed Containers
  • Red Hat Quay 3
  • Red Hat Satellite 6
  • Red Hat Storage 3
  • Red Hat Web Terminal
  • mirror registry for Red Hat OpenShift

Timeline

  1. 2026-10-02 Threatist record created from CVE-2022-30580
  2. 2026-10-03 Alias added: GHSA-2v97-2cxm-mvp4
  3. 2026-10-30 EPSS moved to the 50th–90th percentile

References

Patch 1

Advisory 4

  • TI-2020-00578 Improper certificate validation in Microsoft Windows KEVCVSS 3.1HIGH 8.1
  • TI-2023-23979 The HTTP/2 protocol allows a denial of service (server resource consumption) because… KEVCVSS 3.1HIGH 7.5
  • TI-2018-05208 The "go get" implementation in Go 1.9.4, when the -insecure command-line option is used… CVSS 3.1HIGH 8.8
  • TI-2018-12083 Improper input validation in [UNKNOWN] golang CVSS 3.1HIGH 8.1
  • TI-2024-16306 Mishandling of corrupt central directory record in archive/zip CVSS 3.1MEDIUM 5.5
  • TI-2021-15910 Go before 1.16.9 and 1.17.x before 1.17.2 has a Buffer Overflow via large arguments in a… CVSS 3.1CRITICAL 9.8
See all 170 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences