id: GO-2022-0532
modules:
    - module: std
      versions:
        - fixed: 1.17.11
        - introduced: 1.18.0-0
          fixed: 1.18.3
      vulnerable_at: 1.18.2
      packages:
        - package: os/exec
          goos:
            - windows
          symbols:
            - Cmd.Start
summary: Empty Cmd.Path can trigger unintended binary in os/exec on Windows
description: |-
    On Windows, executing Cmd.Run, Cmd.Start, Cmd.Output, or Cmd.CombinedOutput when
    Cmd.Path is unset will unintentionally trigger execution of any binaries in the
    working directory named either "..com" or "..exe".
published: 2022-07-26T21:41:20Z
credits:
    - Chris Darroch (chrisd8088@github.com)
    - brian m. carlson (bk2204@github.com)
    - Mikhail Shcherbakov (https://twitter.com/yu5k3)
references:
    - fix: https://go.dev/cl/403759
    - fix: https://go.googlesource.com/go/+/960ffa98ce73ef2c2060c84c7ac28d37a83f345e
    - report: https://go.dev/issue/52574
    - web: https://groups.google.com/g/golang-announce/c/TzIC9-t8Ytg/m/IWz5T6x7AAAJ
cve_metadata:
    id: CVE-2022-30580
    cwe: 'CWE-94: Improper Control of Generation of Code (''Code Injection'')'
    description: |-
        Code injection in Cmd.Start in os/exec before Go 1.17.11 and Go 1.18.3 allows
        execution of any binaries in the working directory named either "..com" or
        "..exe" by calling Cmd.Run, Cmd.Start, Cmd.Output, or Cmd.CombinedOutput when
        Cmd.Path is unset.