Vulnerability GO-2026-5426
Unknown
UNKNOWN RISK
Vulnerabilities without an assigned CVSS score. Severity is not determinable from available data.
2 months ago
July 24, 2026 at 06:35 PM UTC
Opentelemetry-go: BSD kenv command not using absolute path enables PATH hijacking in go.opentelemetry.io/otel/sdk
v1.15.0 - v1.42.0
v1.15.0 - v1.42.0
Summary
Opentelemetry-go: BSD kenv command not using absolute path enables PATH hijacking in go.opentelemetry.io/otel/sdk
Details
Opentelemetry-go: BSD kenv command not using absolute path enables PATH hijacking in go.opentelemetry.io/otel/sdk
References
Related Vulnerabilities
Other vulnerabilities affecting the same packages
Medium Risk
1 day ago
OpenTelemetry-Go: UTF-8 replacement rune bypasses attribute length truncation
v1.10.0 - v1.32.0 GHSA-p9f8-wvj8-2fg8
v1.10.0 - v1.32.0 GHSA-p9f8-wvj8-2fg8
Low Risk
13 days ago
OpenTelemetry-Go: Exporter config logging may leak endpoint URLs in info logs
v1.5.0 - v1.44.0 GHSA-8wmf-6v46-5gfg
v1.5.0 - v1.44.0 GHSA-8wmf-6v46-5gfg
High Risk
5 months ago
opentelemetry-go: BSD kenv command not using absolute path enables PATH hijacking
v1.15.0 - v1.42.0 GHSA-hfvc-g4fc-pqhx
v1.15.0 - v1.42.0 GHSA-hfvc-g4fc-pqhx
Unknown
7 months ago
OpenTelemetry Go SDK Vulnerable to Arbitrary Code Execution via PATH Hijacking in go.opentelemetry.io/otel/sdk
v1.21.0 - v1.39.0 GO-2026-4394
v1.21.0 - v1.39.0 GO-2026-4394
High Risk
8 months ago
OpenTelemetry Go SDK Vulnerable to Arbitrary Code Execution via PATH Hijacking
v1.21.0 - v1.39.0 GHSA-9h8m-3fm2-qjrq
v1.21.0 - v1.39.0 GHSA-9h8m-3fm2-qjrq
Impacted packages
Timeline
Published
2 months ago
July 24, 2026 at 06:35 PM UTC
Last Modified
2 months ago
July 30, 2026 at 03:59 PM UTC