CVE-2022-30580 Empty Cmd.Path can trigger unintended binary in os/exec on Windows
Attackers can execute arbitrary binaries from the working directory if Cmd.Path is unset in Go's os/exec package on Windows.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2022-30580?
CVE-2022-30580 is a high-severity code injection vulnerability in Golang Go, published on 9 Aug 2022. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
Code injection in Cmd.Start in os/exec before Go 1.17.11 and Go 1.18.3 allows execution of any binaries in the working directory named either "..com" or "..exe" by calling Cmd.Run, Cmd.Start, Cmd.Output, or Cmd.CombinedOutput when Cmd.Path is unset.
Weakness: CWE-94
Which versions are affected by CVE-2022-30580?
2 open source packages ship an affected version, including golang and stdlib. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
golang Bitnami | All versions | 1.17.11, 1.18.3 |
stdlib Go | All versions | 1.17.11, 1.18.3 |
Products include Golang Go.
How do I fix CVE-2022-30580?
Upgrade golang to a fixed version for your release line: 1.17.11 or 1.18.3.
Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.
Is CVE-2022-30580 being exploited?
There is no known exploitation of CVE-2022-30580 in the wild and no public exploit code.
Other vulnerabilities in Golang Go
- CVE-2020-0601 Microsoft Windows CryptoAPI Spoofing
- CVE-2026-27143 Missing bound checks can lead to memory corruption in safe Go in cmd/compile
- CVE-2024-24790 Unexpected behavior from Is methods for IPv4-mapped IPv6 addresses in net/netip
- CVE-2023-39320 Arbitrary code execution via go.mod toolchain directive in cmd/go
- CVE-2023-24540 Improper handling of JavaScript whitespace in html/template
Sources
Also known as AZL-10532, AZL-79108, AZL-98856, BIT-golang-2022-30580, GHSA-2v97-2cxm-mvp4, GO-2022-0532.