{"answers":{"affected":"4 open source packages ship an affected version, including go.mozilla.org/sops/v3 and go.mozilla.org/sops.","exploited":"There is no known exploitation of GHSA-x5c7-x7m2-rhmf in the wild and no public exploit code.","fix":"Upgrade go.mozilla.org/sops/v3 to 3.7.1 or later.","what":"GHSA-x5c7-x7m2-rhmf is a command injection vulnerability in go.mozilla.org/sops, published on 20 May 2021. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link."},"fix_prompt":"Check this codebase for GHSA-x5c7-x7m2-rhmf and fix it if it is affected.\n\nWhat it is: GHSA-x5c7-x7m2-rhmf is a command injection vulnerability in go.mozilla.org/sops, published on 20 May 2021. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link.\nExploitation: There is no known exploitation of GHSA-x5c7-x7m2-rhmf in the wild and no public exploit code.\n\nAffected packages and fixed versions:\n- go.mozilla.org/sops/v3 (Go): affected all versions; fixed in 3.7.1\n- go.mozilla.org/sops/v3 (Go): affected all versions; fixed in 3.7.1\n- go.mozilla.org/sops/v3 (Go): affected all versions; fixed in 3.7.1\n- go.mozilla.org/sops (Go): affected all versions; no fix listed\n\nTask:\n1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.\n2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.\n3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.\n4. Run the tests and summarise what changed and why.\n5. If nothing in the project is affected, say so and change nothing.\n\nReference: https://insights.sbomify.com/GHSA-x5c7-x7m2-rhmf/ (Markdown: https://insights.sbomify.com/GHSA-x5c7-x7m2-rhmf/index.md)","id":"GHSA-x5c7-x7m2-rhmf","markdown":"https://insights.sbomify.com/GHSA-x5c7-x7m2-rhmf/index.md","name":"GHSA-x5c7-x7m2-rhmf","record":{"aliases":["GO-2022-0410"],"analysis":{"component_type":"developer_tool","fix_type":"upgrade","impacts":["code_execution"],"network_reachable":"adjacent_or_local","non_default_config":true,"product_category":"Go secrets management tool","requires_auth":"none","summary":"Local attackers can execute arbitrary code on Windows by placing malicious executables in the current directory when using sops via cmd.exe.","user_interaction":"required","vuln_class":"command_injection"},"analysis_generated_by":"qwen3.8-flash-next","assigner":null,"cpe":[],"cvss":{"score":null,"severity":null,"source":null,"vector":null,"version":null},"cwes":[],"description":"### Impact\nWindows users using the sops direct editor option (`sops file.yaml`) can have a local executable named either `vi`, `vim`, or `nano` executed if running sops from `cmd.exe`\n\nThis attack is only viable if an attacker is able to place a malicious binary within the directory you are running sops from. As well, this attack will only work when using `cmd.exe` or the Windows C library [SearchPath function](https://docs.microsoft.com/en-us/windows/win32/api/processenv/nf-processenv-searchpatha). This is a result of these Windows tools including `.` within their `PATH` by default.\n\n**If you are using sops within untrusted directories on Windows via `cmd.exe`, please upgrade immediately** \n\n**As well, if you have `.` within your default $PATH, please upgrade immediately.**\n\nMore information can be found on the official Go blog: https://blog.golang.org/path-security\n\n### Patches\nThe problem has been resolved in v3.7.1\n\nNow, if Windows users using cmd.exe run into this issue, a warning message will be printed:\n`vim resolves to executable in current directory (.\\vim.exe)`\n\n### References\n* https://blog.golang.org/path-security\n\n### For more information\nIf you have any questions or comments about this advisory:\n* Open a discussion in [sops](https://github.com/mozilla/sops/discussions)","ecosystems":["Go"],"exploits":{"exploitdb":null,"first_seen":null,"github_poc":null,"max_poc_stars":null,"metasploit":null,"nuclei":null,"refs":[],"tier":null},"has_fix":true,"headline":"Local directory executable lookup in sops (Windows-only)","id":"GHSA-x5c7-x7m2-rhmf","indexable":true,"kev":null,"kind":"advisory","links":{"ecosystem":"Go","product":null,"products":[],"type":"command_injection","year":"2021"},"n_packages":4,"n_references":null,"packages":[{"ecosystem":"Go","fixed":[],"introduced":["0"],"last_affected":[],"package":"go.mozilla.org/sops","purl":"pkg:golang/go.mozilla.org/sops","source":"GO-2022-0410"},{"ecosystem":"Go","fixed":["3.7.1"],"introduced":["0"],"last_affected":[],"package":"go.mozilla.org/sops/v3","purl":null,"source":"GHSA-x5c7-x7m2-rhmf"},{"ecosystem":"Go","fixed":["3.7.1"],"introduced":["0"],"last_affected":[],"package":"go.mozilla.org/sops/v3","purl":"pkg:golang/go.mozilla.org/sops/v3","source":"GHSA-x5c7-x7m2-rhmf"},{"ecosystem":"Go","fixed":["3.7.1"],"introduced":["0"],"last_affected":[],"package":"go.mozilla.org/sops/v3","purl":"pkg:golang/go.mozilla.org/sops/v3","source":"GO-2022-0410"}],"products":null,"published":"2021-05-20","related":[],"sources":[{"class":"attribution","licence":"CC BY 4.0","name":"GitHub Advisory Database","prefix":"GHSA"},{"class":"attribution","licence":"CC BY 4.0","name":"Go Vulnerability Database","prefix":"GO"}],"ssvc":{"automatable":null,"exploitation":null,"technical_impact":null},"state":null,"updated":null,"vendors":null},"summary":"Local attackers can execute arbitrary code on Windows by placing malicious executables in the current directory when using sops via cmd.exe.","url":"https://insights.sbomify.com/GHSA-x5c7-x7m2-rhmf/"}