CVE-2022-30580

score

<0.1

cvss

7.8

epss

0.6%

published

2022-08-10

kev added

—

first seen

2026-10-21

Go < 1.17.11, 1.18.3 contain a code injection caused by insecure handling of Cmd.Path in os/exec, letting attackers execute arbitrary binaries named '..com' or '..exe' in the working directory when calling Cmd.Run, Cmd.Start, Cmd.Output, or Cmd.CombinedOutput with Cmd.Path unset.