CVE-2025-47906
📋 TL;DR
This vulnerability in Go's LookPath function allows unexpected binary execution when PATH contains executable files instead of directories. Attackers could trick applications into running malicious binaries by manipulating PATH entries. Affects Go programs that use LookPath with user-controlled input.
💻 Affected Systems
- Go programming language
📦 What is this software?
Go by Golang
Go by Golang
⚠️ Risk & Real-World Impact
Worst Case
Remote code execution if attacker controls PATH variable and can influence LookPath calls with empty string, dot, or dot-dot arguments.
Likely Case
Local privilege escalation or unexpected binary execution in multi-user systems where users can modify PATH.
If Mitigated
Limited impact if PATH is properly sanitized and LookPath inputs are validated.
🎯 Exploit Status
Requires ability to modify PATH environment variable and influence LookPath arguments.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Go 1.23.2 or Go 1.22.11
Vendor Advisory: https://groups.google.com/g/golang-announce/c/x5MKroML2yM
Restart Required: No
Instructions:
1. Update Go installation: go install golang.org/dl/go1.23.2@latest 2. Run: go1.23.2 download 3. Set PATH to use new version or rebuild applications with updated Go.
🔧 Temporary Workarounds
Sanitize PATH environment variable
allEnsure PATH contains only directory paths, not executable files
export PATH=$(echo $PATH | tr ':' '\n' | grep -v '\.' | tr '\n' ':')
Validate LookPath inputs
allReject empty strings, single dot, and double dot in code calling LookPath
🧯 If You Can't Patch
- Audit all code using os/exec.LookPath and add input validation
- Implement strict PATH environment variable controls in deployment
🔍 How to Verify
Check if Vulnerable:
Check Go version: go version. If below 1.23.2 or 1.22.11, vulnerable.Check Version:
go versionVerify Fix Applied:
After update, verify with: go version | grep -E 'go1\.(23\.2|22\.11)'📡 Detection & Monitoring
Log Indicators:
- Unexpected binary execution from PATH entries
- Failed LookPath calls with unusual arguments
Network Indicators:
- Unusual outbound connections from Go applications
SIEM Query:
process.name:go AND (cmdline:*LookPath* OR env.PATH:*\.*)