REDHAT-BUG-2396546: Medium severity go Go (os/exec LookPath) vulnerability
Published Sep 18, 2025
·Updated
If the PATH environment variable contains paths which are executables (rather than just directories), passing certain strings to LookPath ("", ".", and ".."), can result in the binaries listed in the PATH being unexpectedly returned.
Affected Software
1 affected component
go Go (os/exec LookPath)
Event History
Sep 18, 2025
Data Sourced
via Red Hat·07:01 PM
DescriptionSeverityAffected Software
Frequently Asked Questions
1
What is the severity of REDHAT-BUG-2396546?
The severity of REDHAT-BUG-2396546 is considered to be high, as it can lead to unintended execution of binaries.
2
How do I fix REDHAT-BUG-2396546?
To fix REDHAT-BUG-2396546, ensure that the PATH environment variable only contains directory paths and does not include executable files.
3
What systems are affected by REDHAT-BUG-2396546?
REDHAT-BUG-2396546 affects systems using Go that utilize the os/exec LookPath function.
4
What are the potential risks of REDHAT-BUG-2396546?
The potential risks of REDHAT-BUG-2396546 include executing unintended binaries, which could compromise system security.
5
When was REDHAT-BUG-2396546 reported?
REDHAT-BUG-2396546 was reported in 2023.