onyx --cves cve-2022-41716

CVE-2022-41716

HIGHGo

score: <0.1
cvss: 7.5
epss: 0.9%
published: 2022-11-02
kev added: —
first seen: 2026-10-21

The system contains a vulnerability caused by unsanitized NUL values in environment variables in syscall.StartProcess and os/exec.Cmd, letting attackers maliciously set environment variables, exploit requires attacker to control environment variable input.

Timeline

How this CVE moved toward exploitation. Chart: last 30 days — trend score, EPSS, community mentions per day; hover the event lane.

2022-11-02 Published
2026-10-21 Tracked by Onyx

Weaknesses

NVD-CWE-Other

References 5

https://go.dev/cl/446916
https://go.dev/issue/56284
https://groups.google.com/g/golang-announce/c/mbHY1UY3BaM/m/hSpmRzk-AgAJ
https://pkg.go.dev/vuln/GO-2022-1095
https://security.netapp.com/advisory/ntap-20230120-0007/