Unexpected paths returned from LookPath in os/exec
Priority LOW 30Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- —
- Confidentiality · integrity · availability
- Low · None · Low
- Fix status
- Partial Red Hat: 17 fixed, 80 without a fix
Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA and Red Hat.
Summary
If the PATH environment variable contains paths which are executables (rather than just directories), passing certain strings to LookPath ("", ".", and ".."), can result in the binaries listed in the PATH being unexpectedly returned.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.0055 46th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Partial os/exec (Go standard library): 1.23.12, 1.24.6Red Hat: 21 advisoriesRed Hat: 17 fixed, 80 without a fix
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Go standard library | os/exec | before 1.23.12; 1.24.0 to before 1.24.6 | 1.23.12, 1.24.6 | Patch available | CNA |
- os/exec VendorGo standard library Affected before 1.23.12; 1.24.0 to before 1.24.6 Fixed in 1.23.12, 1.24.6 Patch available CNA
CPE configurations NVD · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:golang:go:*:*:*:*:*:*:*:* | before 1.23.12; 1.24.0 to before 1.24.6 | Vulnerable | Go standard library |
- cpe:2.3:a:golang:go:*:*:*:*:*:*:*:* Versions before 1.23.12; 1.24.0 to before 1.24.6 Vulnerable ·Go standard library
Remediation
- Fix · CNA os/exec (Go standard library) Fixed in 1.23.12, 1.24.6
Red Hat 21 advisories
- RHSA-2026:19350 Released 2026-05-19 · Red Hat rating Importantgit-lfs security update
- Red Hat Enterprise Linux AppStream (v. 9) git-lfs-3.7.1-4.el9_8
- RHSA-2026:3462 Released 2026-02-27 · Red Hat rating CriticalRed Hat AI Inference Server 3.2.2 (ROCm)
- Red Hat AI Inference Server 3.2 registry.redhat.io/rhaiis/vllm-rocm-rhel9
- RHSA-2026:3461 Released 2026-02-27 · Red Hat rating CriticalRed Hat AI Inference Server 3.2.2 (CUDA)
- Red Hat AI Inference Server 3.2 registry.redhat.io/rhaiis/vllm-cuda-rhel9
Show 18 more Red Hat advisories
- RHSA-2025:23851 Released 2025-12-22 · Red Hat rating Moderatego-rpm-macros security update
- Red Hat Enterprise Linux AppStream E4S (v.9.0) go-filesystem-3.0.9-12.el9_0, go-rpm-macros-3.0.9-12.el9_0, go-rpm-templates-3.0.9-12.el9_0 +1
- RHSA-2025:23834 Released 2025-12-22 · Red Hat rating Moderatego-rpm-macros security update
- Red Hat Enterprise Linux AppStream EUS (v.9.4) go-filesystem-3.2.0-4.el9_4, go-rpm-macros-3.2.0-4.el9_4, go-rpm-templates-3.2.0-4.el9_4 +1
- RHSA-2025:23833 Released 2025-12-22 · Red Hat rating Moderatego-rpm-macros security update
- Red Hat Enterprise Linux AppStream E4S (v.9.2) go-filesystem-3.2.0-2.el9_2, go-rpm-macros-3.2.0-2.el9_2, go-rpm-templates-3.2.0-2.el9_2 +1
- RHSA-2025:23737 Released 2025-12-22 · Red Hat rating Moderatego-toolset:rhel8 security update
- Red Hat Enterprise Linux AppStream E4S (v.8.8) delve-1.9.1-1.module+el8.8.0+16778+5fbb74f5.src::go-toolset:rhel8, delve-1.9.1-1.module+el8.8.0+16778+5fbb74f5.x86_64::go-toolset:rhel8, go-toolset-1.19.13-3.module+el8.8.0+23822+add30b82.ppc64le::go-toolset:rhel8 +12
- Red Hat Enterprise Linux AppStream TUS (v.8.8) delve-1.9.1-1.module+el8.8.0+16778+5fbb74f5.src::go-toolset:rhel8, delve-1.9.1-1.module+el8.8.0+16778+5fbb74f5.x86_64::go-toolset:rhel8, go-toolset-1.19.13-3.module+el8.8.0+23822+add30b82.src::go-toolset:rhel8 +9
- RHSA-2025:23733 Released 2025-12-22 · Red Hat rating Moderatego-toolset:rhel8 security update
- Red Hat Enterprise Linux AppStream AUS (v.8.6) delve-1.7.2-1.module+el8.6.0+12972+ebab5911.src::go-toolset:rhel8, delve-1.7.2-1.module+el8.6.0+12972+ebab5911.x86_64::go-toolset:rhel8, go-toolset-1.17.13-2.module+el8.6.0+22782+bd95fb4c.src::go-toolset:rhel8 +9
- Red Hat Enterprise Linux AppStream E4S (v.8.6) delve-1.7.2-1.module+el8.6.0+12972+ebab5911.src::go-toolset:rhel8, delve-1.7.2-1.module+el8.6.0+12972+ebab5911.x86_64::go-toolset:rhel8, go-toolset-1.17.13-2.module+el8.6.0+22782+bd95fb4c.aarch64::go-toolset:rhel8 +18
- Red Hat Enterprise Linux AppStream TUS (v.8.6) delve-1.7.2-1.module+el8.6.0+12972+ebab5911.src::go-toolset:rhel8, delve-1.7.2-1.module+el8.6.0+12972+ebab5911.x86_64::go-toolset:rhel8, go-toolset-1.17.13-2.module+el8.6.0+22782+bd95fb4c.src::go-toolset:rhel8 +9
- RHSA-2025:23741 Released 2025-12-22 · Red Hat rating Moderatego-toolset:rhel8 security update
- Red Hat Enterprise Linux AppStream AUS (v.8.4) delve-1.5.0-2.module+el8.4.0+8864+58b0fcdb.src::go-toolset:rhel8, delve-1.5.0-2.module+el8.4.0+8864+58b0fcdb.x86_64::go-toolset:rhel8, go-toolset-1.15.14-3.module+el8.4.0+22765+91da4d3f.src::go-toolset:rhel8 +9
- Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.4) delve-1.5.0-2.module+el8.4.0+8864+58b0fcdb.src::go-toolset:rhel8, delve-1.5.0-2.module+el8.4.0+8864+58b0fcdb.x86_64::go-toolset:rhel8, go-toolset-1.15.14-3.module+el8.4.0+22765+91da4d3f.src::go-toolset:rhel8 +9
- RHSA-2025:23740 Released 2025-12-22 · Red Hat rating Moderatego-toolset:rhel8 security update
- Red Hat Enterprise Linux AppStream AUS (v. 8.2) delve-1.3.2-3.module+el8.2.0+5581+896cb53e.src::go-toolset:rhel8, delve-1.3.2-3.module+el8.2.0+5581+896cb53e.x86_64::go-toolset:rhel8, go-toolset-1.13.15-1.module+el8.2.0+7662+fa98b974.src::go-toolset:rhel8 +9
- RHSA-2025:23449 Released 2025-12-17 · Red Hat rating ImportantRed Hat AI Inference Server 3.2.5 (ROCm)
- Red Hat AI Inference Server 3.2 registry.redhat.io/rhaiis/vllm-rocm-rhel9
- RHSA-2025:23205 Released 2025-12-15 · Red Hat rating ImportantRed Hat AI Inference Server 3.2.5 (ROCm)
- Red Hat AI Inference Server 3.2 registry.redhat.io/rhaiis/vllm-rocm-rhel9
- RHSA-2025:22935 Released 2025-12-09 · Red Hat rating ImportantRed Hat Update Infrastructure 5 security update
- Red Hat Update Infrastructure 5 registry.redhat.io/rhui5/cds-rhel9, registry.redhat.io/rhui5/haproxy-rhel9, registry.redhat.io/rhui5/installer-rhel9 +1
- RHSA-2025:22899 Released 2025-12-09 · Red Hat rating Moderategolang security update
- Red Hat Enterprise Linux AppStream E4S (v.9.0) golang-1.17.13-8.el9_0, golang-bin-1.17.13-8.el9_0, golang-docs-1.17.13-8.el9_0 +4
- RHSA-2025:22668 Released 2025-12-03 · Red Hat rating Moderatego-toolset:rhel8 security update
- Red Hat Enterprise Linux AppStream (v. 8) delve-1.25.2-1.module+el8.10.0+23746+9db33b5e.aarch64::go-toolset:rhel8, delve-1.25.2-1.module+el8.10.0+23746+9db33b5e.ppc64le::go-toolset:rhel8, delve-1.25.2-1.module+el8.10.0+23746+9db33b5e.src::go-toolset:rhel8 +22
- RHSA-2025:22181 Released 2025-11-26 · Red Hat rating Moderategolang security update
- Red Hat Enterprise Linux AppStream E4S (v.9.2) golang-1.19.13-20.el9_2, golang-bin-1.19.13-20.el9_2, golang-docs-1.19.13-20.el9_2 +4
- RHSA-2025:22005 Released 2025-11-25 · Red Hat rating Moderatego-rpm-macros security update
- Red Hat Enterprise Linux AppStream (v. 9) go-filesystem-3.6.0-12.el9_7, go-rpm-macros-3.6.0-12.el9_7, go-rpm-templates-3.6.0-12.el9_7 +1
- RHSA-2025:22004 Released 2025-11-25 · Red Hat rating Moderatego-rpm-macros security update
- Red Hat Enterprise Linux AppStream EUS (v.9.6) go-filesystem-3.6.0-11.el9_6, go-rpm-macros-3.6.0-11.el9_6, go-rpm-templates-3.6.0-11.el9_6 +1
- RHSA-2025:21856 Released 2025-11-20 · Red Hat rating Moderategolang security update
- Red Hat Enterprise Linux AppStream EUS (v.9.4) go-toolset-1.21.13-12.el9_4, golang-1.21.13-12.el9_4, golang-bin-1.21.13-12.el9_4 +4
- RHSA-2025:13935 Released 2025-08-18 · Red Hat rating Importantgolang security update
- Red Hat Enterprise Linux AppStream (v. 9) go-toolset-1.24.6-1.el9_6, golang-1.24.6-1.el9_6, golang-bin-1.24.6-1.el9_6 +5
- RHSA-2025:13941 Released 2025-08-18 · Red Hat rating Importantgolang security update
- Red Hat Enterprise Linux AppStream (v. 10) go-toolset-1.24.6-1.el10_0, golang-1.24.6-1.el10_0, golang-bin-1.24.6-1.el10_0 +5
Vendor assessments
Red Hat
Red Hat rating: Moderate. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Assisted Installer for Red Hat OpenShift Container Platform 2 | Affected | No fix yet: Fix deferred |
| Builds for Red Hat OpenShift | Affected | No fix yet: Fix deferred |
| Confidential Compute Attestation | Affected | No fix yet: Fix deferred |
| Cryostat 4 | Affected | No fix yet: Fix deferred |
| Custom Metric Autoscaler operator for Red Hat Openshift | Affected | No fix yet: Fix deferred |
| Deployment Validation Operator | Affected | No fix yet: Fix deferred |
| Fence Agents Remediation Operator | Affected | No fix yet: Fix deferred |
| File Integrity Operator | Affected | No fix yet: Fix deferred |
| Gatekeeper 3 | Affected | No fix yet: Fix deferred |
| Kube Descheduler Operator | Affected | No fix yet: Fix deferred |
| Logging Subsystem for Red Hat OpenShift | Affected | No fix yet: Fix deferred |
| Logical Volume Manager Storage | Affected | No fix yet: Fix deferred |
| Machine Deletion Remediation Operator | Affected | No fix yet: Fix deferred |
| Migration Toolkit for Applications 7 | Affected | No fix yet: Fix deferred |
| Migration Toolkit for Applications 8 | Affected | No fix yet: Fix deferred |
| Migration Toolkit for Containers | Affected | No fix yet: Fix deferred |
| Migration Toolkit for Virtualization | Affected | No fix yet: Fix deferred |
| Multiarch Tuning Operator | Affected | No fix yet: Fix deferred |
| Multicluster Engine for Kubernetes | Affected | No fix yet: Fix deferred |
| Multicluster Global Hub | Affected | No fix yet: Fix deferred |
| NBDE Tang Server | Affected | No fix yet: Fix deferred |
| Network Observability Operator | Affected | No fix yet: Fix deferred |
| Node HealthCheck Operator | Affected | No fix yet: Fix deferred |
| Node Maintenance Operator | Affected | No fix yet: Fix deferred |
| OpenShift API for Data Protection | Affected | No fix yet: Fix deferred |
| OpenShift Developer Tools and Services | Affected | No fix yet: Fix deferred |
| OpenShift Lightspeed | Affected | No fix yet: Fix deferred |
| OpenShift Pipelines | Affected | No fix yet: Fix deferred |
| OpenShift Run Once Duration Override Operator | Affected | No fix yet: Fix deferred |
| OpenShift Secondary Scheduler Operator | Affected | No fix yet: Fix deferred |
| OpenShift Serverless | Affected | No fix yet: Fix deferred |
| OpenShift Service Mesh 2 | Affected | No fix yet: Fix deferred |
| OpenShift Source-to-Image (S2I) | Affected | No fix yet: Fix deferred |
| Power monitoring for Red Hat OpenShift | Affected | No fix yet: Fix deferred |
| Red Hat 3scale API Management Platform 2 | Affected | No fix yet: Fix deferred |
| Red Hat AMQ Clients | Affected | No fix yet: Fix deferred |
| Red Hat Advanced Cluster Management for Kubernetes 2 | Affected | No fix yet: Fix deferred |
| Red Hat Advanced Cluster Security 4 | Affected | No fix yet: Fix deferred |
| Red Hat Ansible Automation Platform 2 | Affected | No fix yet: Fix deferred |
| Red Hat Ceph Storage 5 | Affected | No fix yet: Fix deferred |
| Red Hat Ceph Storage 6 | Affected | No fix yet: Fix deferred |
| Red Hat Ceph Storage 7 | Affected | No fix yet: Fix deferred |
| Red Hat Ceph Storage 8 | Affected | No fix yet: Fix deferred |
| Red Hat Certification Program for Red Hat Enterprise Linux 9 | Affected | No fix yet: Fix deferred |
| Red Hat Certification for Red Hat Enterprise Linux 8 | Affected | No fix yet: Fix deferred |
| Red Hat Connectivity Link 1 | Affected | No fix yet: Fix deferred |
| Red Hat Developer Hub 1 | Affected | No fix yet: Fix deferred |
| Red Hat Edge Manager preview | Affected | No fix yet: Fix deferred |
| Red Hat Enterprise Linux 10 | Affected | No fix yet: Fix deferred |
| Red Hat Enterprise Linux 7 | Affected | No fix yet: Fix deferred |
| Red Hat Enterprise Linux 8 | Affected | No fix yet: Fix deferred |
| Red Hat Enterprise Linux 9 | Affected | No fix yet: Fix deferred |
| Red Hat OpenShift AI (RHOAI) | Affected | No fix yet: Fix deferred |
| Red Hat OpenShift Cluster Manager CLI | Affected | No fix yet: Fix deferred |
| Red Hat OpenShift Container Platform 4 | Affected | No fix yet: Fix deferred |
| Red Hat OpenShift Dev Spaces | Affected | No fix yet: Fix deferred |
| Red Hat OpenShift Dev Workspaces Operator | Affected | No fix yet: Fix deferred |
| Red Hat OpenShift GitOps | Affected | No fix yet: Fix deferred |
| Red Hat OpenShift Update Service | Affected | No fix yet: Fix deferred |
| Red Hat OpenShift Virtualization 4 | Affected | No fix yet: Fix deferred |
| Red Hat OpenShift distributed tracing 3 | Affected | No fix yet: Fix deferred |
| Red Hat OpenShift for Windows Containers | Affected | No fix yet: Fix deferred |
| Red Hat OpenShift on AWS | Affected | No fix yet: Fix deferred |
| Red Hat OpenStack Platform 16.2 | Affected | No fix yet: Fix deferred |
| Red Hat OpenStack Platform 17.1 | Affected | No fix yet: Fix deferred |
| Red Hat OpenStack Platform 18.0 | Affected | No fix yet: Fix deferred |
| Red Hat Openshift Data Foundation 4 | Affected | No fix yet: Fix deferred |
| Red Hat Quay 3 | Affected | No fix yet: Fix deferred |
| Red Hat Runtimes Inventory Operator | Affected | No fix yet: Fix deferred |
| Red Hat Service Interconnect 2 | Affected | No fix yet: Fix deferred |
| Red Hat Trusted Application Pipeline | Affected | No fix yet: Fix deferred |
| Red Hat Trusted Artifact Signer | Affected | No fix yet: Fix deferred |
| Red Hat Web Terminal | Affected | No fix yet: Fix deferred |
| Red Hat build of Apache Camel - HawtIO 4 | Affected | No fix yet: Fix deferred |
| Self Node Remediation Operator | Affected | No fix yet: Fix deferred |
| Zero Trust Workload Identity Manager - Tech Preview | Affected | No fix yet: Fix deferred |
| cert-manager Operator for Red Hat OpenShift | Affected | No fix yet: Fix deferred |
| external secrets operator for Red Hat OpenShift - Tech Preview | Affected | No fix yet: Fix deferred |
| mirror registry for Red Hat OpenShift | Affected | No fix yet: Fix deferred |
| streams for Apache Kafka 3 | Affected | No fix yet: Fix deferred |
| Red Hat AI Inference Server 3.2 | Fixed | RHSA-2025:23205, RHSA-2025:23449, RHSA-2026:3461, RHSA-2026:3462 |
| Red Hat Enterprise Linux AppStream (v. 10) | Fixed | RHSA-2025:13941 |
| Red Hat Enterprise Linux AppStream (v. 8) | Fixed | RHSA-2025:22668 |
| Red Hat Enterprise Linux AppStream (v. 9) | Fixed | RHSA-2025:13935, RHSA-2025:22005, RHSA-2026:19350 |
| Red Hat Enterprise Linux AppStream AUS (v. 8.2) | Fixed | RHSA-2025:23740 |
| Red Hat Enterprise Linux AppStream AUS (v.8.4) | Fixed | RHSA-2025:23741 |
| Red Hat Enterprise Linux AppStream AUS (v.8.6) | Fixed | RHSA-2025:23733 |
| Red Hat Enterprise Linux AppStream E4S (v.8.6) | Fixed | RHSA-2025:23733 |
| Red Hat Enterprise Linux AppStream E4S (v.8.8) | Fixed | RHSA-2025:23737 |
| Red Hat Enterprise Linux AppStream E4S (v.9.0) | Fixed | RHSA-2025:22899, RHSA-2025:23851 |
| Red Hat Enterprise Linux AppStream E4S (v.9.2) | Fixed | RHSA-2025:22181, RHSA-2025:23833 |
| Red Hat Enterprise Linux AppStream EUS (v.9.4) | Fixed | RHSA-2025:21856, RHSA-2025:23834 |
| Red Hat Enterprise Linux AppStream EUS (v.9.6) | Fixed | RHSA-2025:22004 |
| Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.4) | Fixed | RHSA-2025:23741 |
| Red Hat Enterprise Linux AppStream TUS (v.8.6) | Fixed | RHSA-2025:23733 |
| Red Hat Enterprise Linux AppStream TUS (v.8.8) | Fixed | RHSA-2025:23737 |
| Red Hat Update Infrastructure 5 | Fixed | RHSA-2025:22935 |
Not affected: 1 product
- Red Hat Update Infrastructure 5
Timeline
- 2026-10-02 Threatist record created from CVE-2025-47906
- 2026-10-03 Alias added: GHSA-gwrf-jf3h-w649
- 2026-10-13 Fix available: RHSA-2026:19350 · Red Hat
- 2026-10-13 Affected versions changed · Red Hat
- 2026-10-27 Affected versions changed · Red Hat
References
More Go standard library Go vulnerabilities
- TI-2020-00578 Improper certificate validation in Microsoft Windows KEVCVSS 3.1HIGH 8.1
- TI-2023-23979 The HTTP/2 protocol allows a denial of service (server resource consumption) because… KEVCVSS 3.1HIGH 7.5
- TI-2018-05208 The "go get" implementation in Go 1.9.4, when the -insecure command-line option is used… CVSS 3.1HIGH 8.8
- TI-2018-12083 Improper input validation in [UNKNOWN] golang CVSS 3.1HIGH 8.1
- TI-2024-16306 Mishandling of corrupt central directory record in archive/zip CVSS 3.1MEDIUM 5.5
- TI-2021-15910 Go before 1.16.9 and 1.17.x before 1.17.2 has a Buffer Overflow via large arguments in a… CVSS 3.1CRITICAL 9.8
Sources
- CVE-2025-47906 · CVE Program
- CVE-2025-47906 · NVD
- FIRST EPSS
- GHSA-gwrf-jf3h-w649 · GitHub Advisory Database · CC BY 4.0
- CVE-2025-47906 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences