CVE-2022-30580 - CVE House
Back to Database
Status published Unknown CVE-2022-30580

Empty Cmd.Path can trigger unintended binary in os/exec on Windows

Vulnerability Description

Code injection in Cmd.Start in os/exec before Go 1.17.11 and Go 1.18.3 allows execution of any binaries in the working directory named either "..com" or "..exe" by calling Cmd.Run, Cmd.Start, Cmd.Output, or Cmd.CombinedOutput when Cmd.Path is unset.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2022-30580

Credits & Attribution

The following person or organization is credited with identifying this vulnerability, as recorded in the NVD database:

  • Chris Darroch (chrisd8088@github.com)
  • brian m. carlson (bk2204@github.com)
  • Mikhail Shcherbakov (https://twitter.com/yu5k3)

References

More from Go standard library

View All →
CVE-2025-68121
Unexpected session resumption in crypto/tls
Unknown 0
CVE-2025-61730
Handshake messages may be processed at the incorrect encryption level in crypto/tls
Unknown 0
CVE-2025-61729
Excessive resource consumption when printing error string for host certificate validation in crypto/x509
Unknown 0
CVE-2025-61728
Excessive CPU consumption when building archive index in archive/zip
Unknown 0
CVE-2025-61727
Improper application of excluded DNS name constraints when verifying wildcard names in crypto/x509
Unknown 0

Affected Vendor

Go standard library

View all reports →

Affected Software

os/exec
Vulnerable Versions:
0, 1.18.0-0

Timeline

Official Publish: August 9th, 2022
Last Modified: March 6th, 2026
Added to House: July 21st, 2026

CVSS Vectors

No vector data available

Weaknesses (CWE)

No CWE data available

MITRE ATT&CK TTPs

No associated TTPs found for this vulnerability.