CVE-2022-30580

HighCVSS 7.8/10Last modified Jun 17, 2026

Description

Code injection in Cmd.Start in os/exec before Go 1.17.11 and Go 1.18.3 allows execution of any binaries in the working directory named either "..com" or "..exe" by calling Cmd.Run, Cmd.Start, Cmd.Output, or Cmd.CombinedOutput when Cmd.Path is unset.

Metrics

CVSS 3.1 7.8/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-94

Affected software

Vendor	Product	Versions
Go standard library	os/exec	< 1.17.11; >= 1.18.0-0, < 1.18.3

References

https://go.dev/cl/403759Vendor Advisory
https://go.dev/issue/52574Issue Tracking, Third Party Advisory
https://go.googlesource.com/go/+/960ffa98ce73ef2c2060c84c7ac28d37a83f345eMailing List, Patch, Vendor Advisory
https://groups.google.com/g/golang-announce/c/TzIC9-t8Ytg/m/IWz5T6x7AAAJMailing List, Third Party Advisory
https://pkg.go.dev/vuln/GO-2022-0532Vendor Advisory
https://go.dev/cl/403759Vendor Advisory
https://go.dev/issue/52574Issue Tracking, Third Party Advisory
https://go.googlesource.com/go/+/960ffa98ce73ef2c2060c84c7ac28d37a83f345eMailing List, Patch, Vendor Advisory
https://groups.google.com/g/golang-announce/c/TzIC9-t8Ytg/m/IWz5T6x7AAAJMailing List, Third Party Advisory
https://pkg.go.dev/vuln/GO-2022-0532Vendor Advisory

Timeline

Published: Aug 10, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-305848.8Archer Platform 6.3 before 6.11 (6.11.0.0) contains an Improper Access Control Vulnerability within SSO ADFS functionality that could potent CVE-2022-305856.5The REST API in Archer Platform 6.x before 6.11 (6.11.0.0) contains an Authorization Bypass Vulnerability. A remote authenticated malicious CVE-2022-305867.2Gradle Enterprise through 2022.2.2 has Incorrect Access Control that leads to code execution.CVE-2022-305877.5Gradle Enterprise through 2022.2.2 has Incorrect Access Control that leads to information disclosure.CVE-2022-30597.5The application was vulnerable to multiple instances of SQL injection (authenticated and unauthenticated) through a vulnerable parameter. Du CVE-2022-305917.5quic-go through 0.27.0 allows remote attackers to cause a denial of service (CPU consumption) via a Slowloris variant in which incomplete QU CVE-2022-305929.8liblsquic/lsquic_qenc_hdl.c in LiteSpeed QUIC (aka LSQUIC) before 3.1.0 mishandles MAX_TABLE_CAPACITY.CVE-2022-305947.8The Linux kernel before 5.17.2 mishandles seccomp permissions. The PTRACE_SEIZE code path allows attackers to bypass intended restrictions o CVE-2022-305959.8libImaging/TgaRleDecode.c in Pillow 9.1.0 has a heap buffer overflow in the processing of invalid TGA image files.CVE-2022-305965.4A flaw was found in moodle where ID numbers displayed when bulk allocating markers to assignments required additional sanitizing to prevent CVE-2022-305975.3A flaw was found in moodle where the description user field was not hidden when being set as a hidden user field.CVE-2022-305984.3A flaw was found in moodle where global search results could include author information on some activities where a user may not otherwise ha