CVE-2022-30580

HighCVSS 7.8/10Last modified Jun 17, 2026

Description

Code injection in Cmd.Start in os/exec before Go 1.17.11 and Go 1.18.3 allows execution of any binaries in the working directory named either "..com" or "..exe" by calling Cmd.Run, Cmd.Start, Cmd.Output, or Cmd.CombinedOutput when Cmd.Path is unset.

Metrics

CVSS 3.1 7.8/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-94

Affected software

No affected versions have been published.

Timeline

Published: Aug 10, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-305848.8Archer Platform 6.3 before 6.11 (6.11.0.0) contains an Improper Access Control Vulnerability within SSO ADFS functionality that could potent CVE-2022-305856.5The REST API in Archer Platform 6.x before 6.11 (6.11.0.0) contains an Authorization Bypass Vulnerability. A remote authenticated malicious CVE-2022-305867.2Gradle Enterprise through 2022.2.2 has Incorrect Access Control that leads to code execution.CVE-2022-305877.5Gradle Enterprise through 2022.2.2 has Incorrect Access Control that leads to information disclosure.CVE-2022-30597.5The application was vulnerable to multiple instances of SQL injection (authenticated and unauthenticated) through a vulnerable parameter. Du CVE-2022-305917.5quic-go through 0.27.0 allows remote attackers to cause a denial of service (CPU consumption) via a Slowloris variant in which incomplete QU CVE-2022-305929.8liblsquic/lsquic_qenc_hdl.c in LiteSpeed QUIC (aka LSQUIC) before 3.1.0 mishandles MAX_TABLE_CAPACITY.CVE-2022-305947.8The Linux kernel before 5.17.2 mishandles seccomp permissions. The PTRACE_SEIZE code path allows attackers to bypass intended restrictions o CVE-2022-305959.8libImaging/TgaRleDecode.c in Pillow 9.1.0 has a heap buffer overflow in the processing of invalid TGA image files.CVE-2022-305965.4A flaw was found in moodle where ID numbers displayed when bulk allocating markers to assignments required additional sanitizing to prevent CVE-2022-305975.3A flaw was found in moodle where the description user field was not hidden when being set as a hidden user field.CVE-2022-305984.3A flaw was found in moodle where global search results could include author information on some activities where a user may not otherwise ha