Vulnerability GO-2025-3956
Unknown
UNKNOWN RISK
Vulnerabilities without an assigned CVSS score. Severity is not determinable from available data.
1 year ago
September 18, 2025 at 06:21 PM UTC
Unexpected paths returned from LookPath in os/exec
<1.23.12, >=1.24.0 <1.24.6
<1.23.12, >=1.24.0 <1.24.6
Summary
Unexpected paths returned from LookPath in os/exec
Details
If the PATH environment variable contains paths which are executables (rather than just directories), passing certain strings to LookPath ("", ".", and ".."), can result in the binaries listed in the PATH being unexpectedly returned.
References
Related Vulnerabilities
Other vulnerabilities affecting the same packages
Unknown
5 days ago
Reset context tracking on consecutive template expressions in html/template
<1.26.9, >=1.27.0-0 <1.27.2 GO-2026-6599
<1.26.9, >=1.27.0-0 <1.27.2 GO-2026-6599
Unknown
5 days ago
Recognize yield as regexp preceder keyword in html/template
<1.26.9, >=1.27.0-0 <1.27.2 GO-2026-6600
<1.26.9, >=1.27.0-0 <1.27.2 GO-2026-6600
Unknown
5 days ago
HTTP/2 server memory exhaustion due to Trailer headers in net/http
<1.26.9, >=1.27.0-0 <1.27.2 GO-2026-6603
<1.26.9, >=1.27.0-0 <1.27.2 GO-2026-6603
Unknown
5 days ago
Root.Mkdir(All) can follow junctions out of the root on Windows in os
<1.26.9, >=1.27.0-0 <1.27.2 GO-2026-6604
<1.26.9, >=1.27.0-0 <1.27.2 GO-2026-6604
Unknown
5 days ago
HTTP/1 client connection desynchronization after CONNECT rejection in net/http
<1.26.9, >=1.27.0-0 <1.27.2 GO-2026-6605
<1.26.9, >=1.27.0-0 <1.27.2 GO-2026-6605
Impacted packages
Timeline
Published
1 year ago
September 18, 2025 at 06:21 PM UTC
Last Modified
4 hours ago
October 14, 2026 at 10:57 AM UTC