CVE-2025-47906

MediumCVSS 6.5/10Last modified Jun 17, 2026

Description

If the PATH environment variable contains paths which are executables (rather than just directories), passing certain strings to LookPath ("", ".", and ".."), can result in the binaries listed in the PATH being unexpectedly returned.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L

Affected software

Vendor	Product	Versions
Go standard library	os/exec	< 1.23.12; >= 1.24.0, < 1.24.6

References

https://go.dev/cl/691775Patch
https://go.dev/issue/74466Exploit, Issue Tracking, Third Party Advisory
https://groups.google.com/g/golang-announce/c/x5MKroML2yMMailing List, Release Notes
https://pkg.go.dev/vuln/GO-2025-3956Vendor Advisory
http://www.openwall.com/lists/oss-security/2025/08/06/1Issue Tracking, Mailing List

Timeline

Published: Sep 18, 2025
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-479077.0Cancelling a query (e.g. by cancelling the context passed to one of the query methods) during a call to the Scan method of the returned Rows CVE-2025-479087.5Middleware causes a prohibitive amount of heap allocations when processing malicious preflight requests that include a Access-Control-Reques CVE-2025-479097.3Hosts listed in TrustedOrigins implicitly allow requests from the corresponding HTTP origins, allowing network MitMs to perform CSRF attacks CVE-2025-47919.8A vulnerability has been found in FreeFloat FTP Server 1.0 and classified as critical. This vulnerability affects unknown code of the compon CVE-2025-479105.4When using http.CrossOriginProtection, the AddInsecureBypassPattern method can unexpectedly bypass more requests than intended. CrossOriginP CVE-2025-479115.3The html.Parse function in golang.org/x/net/html has quadratic parsing complexity when processing certain inputs, which can lead to denial o CVE-2025-479125.3The Parse function permits values other than IPv6 addresses to be included in square brackets within the host component of a URL. RFC 3986 p CVE-2025-479137.5SSH clients receiving SSH_AGENT_SUCCESS when expecting a typed response will panic and cause early termination of the client process.CVE-2025-479145.3SSH Agent servers do not validate the size of messages when processing new identity requests, which may cause the program to panic if the me CVE-2025-479169.8Invision Community 5.0.0 before 5.0.7 allows remote code execution via crafted template strings to themeeditor.php. The issue lies within th CVE-2025-479179.8Mbed TLS before 3.6.4 allows a use-after-free in certain situations of applications that are developed in accordance with the documentation.CVE-2025-47929.8A vulnerability was found in FreeFloat FTP Server 1.0 and classified as critical. This issue affects some unknown processing of the componen