ZeroDay Findings
Sign inSign up

Findings

CVE-2025-47906

Unexpected paths returned from LookPath in os/exec

Published Sep 18, 2025 · updated Oct 14, 2026

If the PATH environment variable contains paths which are executables (rather than just directories), passing certain strings to LookPath ("", ".", and ".."), can result in the binaries listed in the PATH being unexpectedly returned.

Timeline

Detection, updates, and resolution for this record.

  1. Sep 18, 2025 · OSV.dev

    Detected

    If the PATH environment variable contains paths which are executables (rather than just directories), passing certain strings to LookPath ("", ".", and ".."), can result in the binaries listed in the PATH being unexpectedly returned.

  2. Oct 14, 2026 · OSV.dev

    Fix available

    stdlib fixed in 1.23.12

  3. Oct 14, 2026 · OSV.dev

    Fix available

    stdlib fixed in 1.23.12

  4. Oct 14, 2026 · OSV.dev

    Updated

    If the PATH environment variable contains paths which are executables (rather than just directories), passing certain strings to LookPath ("", ".", and ".."), can result in the binaries listed in the PATH being unexpectedly returned.

Affected

  • Go stdlib0 → 1.23.12

Sources

References

CVE-2025-47906 · ZeroDay Findings