CVE-2026-63644: bird-lg-go: Improper Neutralization of Argument Delimiters in a Command ('Argument Injection') and Exposure of Sensitive Information to an Unauthorized Actor in github.com/xddxdd/bird-lg-go
bird-lg-go is a BIRD looking glass in Go. Prior to version 1.4.7, unsanitized input path enables arbitrary local file read, allowing an unauthenticated remote attacker to read sensitive files such as /etc/shadow and /root/.bashhistory. This issue has been patched in version 1.4.7.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
github.com/xddxdd/bird-lg-goto a version that resolves this vulnerability.Fixed in 1.4.7
Event History
Frequently Asked Questions
Who can exploit this issue?
An unauthenticated remote attacker can exploit the vulnerable input path. No privileges or user interaction are required.
What can an attacker access?
The issue allows arbitrary local file reads. Sensitive files cited in the advisory include /etc/shadow and /root/.bash_history.
Which versions are affected and how is it fixed?
Versions prior to 1.4.7 are affected. Upgrade bird-lg-go to version 1.4.7, which contains the patch.