Vulnerability GO-2026-4394
Unknown
UNKNOWN RISK
Vulnerabilities without an assigned CVSS score. Severity is not determinable from available data.
7 months ago
February 19, 2026 at 05:28 PM UTC
OpenTelemetry Go SDK Vulnerable to Arbitrary Code Execution via PATH Hijacking in go.opentelemetry.io/otel/sdk
v1.21.0 - v1.39.0
v1.21.0 - v1.39.0
Summary
OpenTelemetry Go SDK Vulnerable to Arbitrary Code Execution via PATH Hijacking in go.opentelemetry.io/otel/sdk
Details
OpenTelemetry Go SDK Vulnerable to Arbitrary Code Execution via PATH Hijacking in go.opentelemetry.io/otel/sdk
References
Related Vulnerabilities
Other vulnerabilities affecting the same packages
Medium Risk
1 day ago
OpenTelemetry-Go: UTF-8 replacement rune bypasses attribute length truncation
v1.10.0 - v1.32.0 GHSA-p9f8-wvj8-2fg8
v1.10.0 - v1.32.0 GHSA-p9f8-wvj8-2fg8
Low Risk
13 days ago
OpenTelemetry-Go: Exporter config logging may leak endpoint URLs in info logs
v1.5.0 - v1.44.0 GHSA-8wmf-6v46-5gfg
v1.5.0 - v1.44.0 GHSA-8wmf-6v46-5gfg
Unknown
2 months ago
Opentelemetry-go: BSD kenv command not using absolute path enables PATH hijacking in go.opentelemetry.io/otel/sdk
v1.15.0 - v1.42.0 GO-2026-5426
v1.15.0 - v1.42.0 GO-2026-5426
High Risk
5 months ago
opentelemetry-go: BSD kenv command not using absolute path enables PATH hijacking
v1.15.0 - v1.42.0 GHSA-hfvc-g4fc-pqhx
v1.15.0 - v1.42.0 GHSA-hfvc-g4fc-pqhx
High Risk
8 months ago
OpenTelemetry Go SDK Vulnerable to Arbitrary Code Execution via PATH Hijacking
v1.21.0 - v1.39.0 GHSA-9h8m-3fm2-qjrq
v1.21.0 - v1.39.0 GHSA-9h8m-3fm2-qjrq
Impacted packages
Timeline
Published
7 months ago
February 19, 2026 at 05:28 PM UTC
Last Modified
7 months ago
February 28, 2026 at 02:43 PM UTC