Skip to content
Fencer Vulns
high 7.8

CVE-2022-30580 json

Empty Cmd.Path can trigger unintended binary in os/exec on Windows

published 2022-07-26 4 y ago modified 2026-09-08 2 mo ago also BIT-golang-2022-30580 , EUVD-2022-52429 , GO-2022-0532

cvss
7.8
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
0.7%
EPSS 0.7% chance of exploitation in 30 days, percentile 53%
public exploits
0
none known

Summary

Code injection in Cmd.Start in os/exec before Go 1.17.11 and Go 1.18.3 allows execution of any binaries in the working directory named either "..com" or "..exe" by calling Cmd.Run, Cmd.Start, Cmd.Output, or Cmd.CombinedOutput when Cmd.Path is unset.

Patch / fix

  • bitnami golang 1.17.11, 1.18.3
  • go stdlib 1.17.11, 1.18.3
  • Go standard library os/exec 1.17.11, 1.18.3
  • go1.18-openssl SLES for SAP 15 SP3, SLES 15 SP3-LTSS, SLE Real Time 15 SP3 +6 more 1.18.10.1-150000.1.9.1
  • go1.18 SLE Module for Development Tools 15 SP4, SLE Module for Development Tools 15 SP3, openSUSE Leap 15.4 +1 more 1.18.3-150000.1.20.1
  • go1.17 SLE Module for Development Tools 15 SP4, SLE Module for Development Tools 15 SP3, openSUSE Leap 15.4 +1 more 1.17.11-150000.1.37.1

suse advisories SUSE-SU-2023:2312-1SUSE-SU-2022:2005-1SUSE-SU-2022:2004-1

  • go1.17 openSUSE Tumbleweed 1.17.11-1.1
  • go1.18 openSUSE Tumbleweed 1.18.3-1.1

opensuse advisories openSUSE-SU-2024:12123-1openSUSE-SU-2024:12124-1

  • go Alpine 3.16 1.18.4-r0

alpine advisories ALPINE-CVE-2022-30580

Alpine secdb © Alpine Linux, from https://secdb.alpinelinux.org via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

  • golang CBL-Mariner 2.0 1.18.5-1

azure linux advisories AZL-10532

Azure Linux vulnerability data, Copyright (c) Microsoft Corporation, from https://github.com/microsoft/AzureLinuxVulnerabilityData via OSV, under the MIT licence; changed: normalised to fixed package versions per release. MIT

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2022-30580 updated cvss 7.8

golang: os/exec: Code injection in Cmd.Start

  • Red Hat Custom Metric Autoscaler operator for Red Hat Openshift custom-metrics-autoscaler/custom-metrics-autoscaler-rhel8 Red Hat Logging Subsystem for Red Hat OpenShift openshift-logging/logging-loki-rhel9 Red Hat Migration Toolkit for Containers rhmtc/openshift-velero-plugin-rhel8 Red Hat Migration Toolkit for Virtualization migration-toolkit-virtualization/mtv-controller-rhel9 Red Hat mirror registry for Red Hat OpenShift mirror-registry-container Red Hat Node HealthCheck Operator workload-availability/node-healthcheck-rhel8-operator
    +29 more products
    Red Hat Node Maintenance Operator workload-availability/node-maintenance-rhel8-operator Red Hat OpenShift API for Data Protection oadp/oadp-velero-rhel8 Red Hat OpenShift Developer Tools and Services odo, helm, ocp-tools-4/jenkins-rhel8 Red Hat OpenShift Pipelines openshift-pipelines-client Red Hat OpenShift Secondary Scheduler Operator openshift-secondary-scheduler-operator/secondary-scheduler-operator-rhel8 Red Hat OpenShift Serverless openshift-serverless-clients, openshift-serverless-1/client-kn-rhel8 Red Hat OpenShift Service Mesh 2 openshift-golang-builder-container Red Hat 3scale API Management Platform 2 3scale-amp2/3scale-rhel7-operator Red Hat Advanced Cluster Management for Kubernetes 2 rhacm2/subctl-rhel9 Red Hat Advanced Cluster Security 3 advanced-cluster-security/rhacs-main-rhel8 Red Hat Ansible Automation Platform 2 receptor, openshift-clients Red Hat Application Interconnect 1.0 skupper-cli skupper-cli, skupper-router skupper-router Red Hat Ceph Storage 3 golang, golang-bin, golang-src Red Hat Ceph Storage 5 rhceph/rhceph-5-dashboard-rhel8 Red Hat Enterprise Linux 8 runc, conmon, golang, podman, skopeo, buildah, +60 more Red Hat Enterprise Linux 9 runc, conmon, golang, podman, skopeo, buildah, +51 more Red Hat OpenShift Container Platform 4 runc, cri-o, conmon, podman, skopeo, buildah, +23 more Red Hat Openshift Data Foundation 4 mcg, odf4/cephcsi-rhel9 Red Hat OpenShift Dev Spaces devspaces/devspaces-rhel8-operator Red Hat OpenShift distributed tracing 2 rhosdt/jaeger-agent-rhel8 Red Hat OpenShift GitOps openshift-gitops-kam, openshift-gitops-1/gitops-rhel8 Red Hat OpenShift on AWS rosa Red Hat Openshift Sandboxed Containers openshift-sandboxed-containers/osc-rhel8-operator Red Hat OpenShift Virtualization 4 kubevirt, container-native-virtualization/virt-api Red Hat OpenStack Platform 16.2 etcd, qpid-proton-c, golang-qpid-apache, python3-qpid-proton, collectd-libpod-stats, rhosp-rhel8-tech-preview/osp-director-operator Red Hat Quay 3 quay/clair-rhel8 Red Hat Satellite 6 qpid-proton, qpid-proton-c, qpid-proton-cpp, qpid-proton-tests, python-qpid-proton, rubygem-qpid_proton Red Hat Storage 3 golang, heketi, golang-bin, golang-src, golang-misc, golang-tests, +3 more Red Hat Web Terminal web-terminal-exec-container
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation
none
Automatable
no
Technical impact
total
Assessed
8 mo ago

Exploit prediction

0.70% chance of exploitation in the next 30 days, higher than 53% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
CISA ADP 3.1 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
NVD 3.1 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CNA 3.1 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
OSV 3.1 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Affected packages

ecosystem package affected fixed in
bitnami golang
<1.17.11
>=1.18.0, <1.18.3
1.17.11
1.18.3
go stdlib
<1.17.11
>=1.18.0-0, <1.18.3
1.17.11
1.18.3

Affected products

  • Go standard library os/exec

Classification

Weakness
  • CWE-94 Improper Control of Generation of Code

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.