CVE-2022-30580

· HIGHModified

← All CVEs

CVSS v3.1

7.8

EPSS

0.62%

Published

Aug 10, 2022

Modified

Mar 6, 2026

Public PoC / Exploit (1)

All weaponized →

TrickestTrickest PoC index

Links to public security research (Exploit-DB, Nuclei, Trickest, GitHub) for defensive use only.

Description

Code injection in Cmd.Start in os/exec before Go 1.17.11 and Go 1.18.3 allows execution of any binaries in the working directory named either "..com" or "..exe" by calling Cmd.Run, Cmd.Start, Cmd.Output, or Cmd.CombinedOutput when Cmd.Path is unset.

CVSS Vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weaknesses (CWE)

CWE-94CWE-94

Affected Products (2)

golang · go (up to 1.17.11)vulnerable

golang · go (up to 1.18.3)vulnerable

References (10)

https://go.dev/cl/403759

Vendor Advisory

https://go.dev/issue/52574

Issue TrackingThird Party Advisory

https://go.googlesource.com/go/+/960ffa98ce73ef2c2060c84c7ac28d37a83f345e

Mailing ListPatchVendor Advisory

https://groups.google.com/g/golang-announce/c/TzIC9-t8Ytg/m/IWz5T6x7AAAJ

Mailing ListThird Party Advisory

https://pkg.go.dev/vuln/GO-2022-0532

Vendor Advisory

https://go.dev/cl/403759

Vendor Advisory

https://go.dev/issue/52574

Issue TrackingThird Party Advisory

https://go.googlesource.com/go/+/960ffa98ce73ef2c2060c84c7ac28d37a83f345e

Mailing ListPatchVendor Advisory

https://groups.google.com/g/golang-announce/c/TzIC9-t8Ytg/m/IWz5T6x7AAAJ

Mailing ListThird Party Advisory

https://pkg.go.dev/vuln/GO-2022-0532

Vendor Advisory

KEV Catalog EPSS Scores Vendors All CVEs