CVE-2025-47906: Golang LookPath Vulnerability Leading to Unexpected Executable Returns
Summary
CVE-2025-47906: Unexpected paths returned from LookPath in os/exec. Affects golang across 2 version ranges.
< 1.23.12
>= 1.24.0, < 1.24.6
Fixed in 1.23.12 or 1.24.6, depending on the release line you run. How to fix ↓
Also tracked for
- golang-1.15 · Debian:11
- stdlib · Go
The same CVE-2025-47906 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
Golang, developed by Google, is an open-source programming language designed for simplicity and efficiency in building scalable and high-performance applications. It features garbage collection, strong typing, and built-in support for concurrent programming. However, it is susceptible to vulnerabilities that can affect its execution environment, such as the LookPath function, which is used to find executables in the system's PATH.
Vulnerability Detail
The vulnerability arises when the PATH environment variable contains executable paths instead of just directories. When certain strings (namely "", ".", and "..") are passed to the LookPath function, it may return binaries listed in the PATH unexpectedly. This can lead to security risks, as malicious executables could be executed unintentionally, compromising the integrity of the application and potentially leading to unauthorized access or data breaches.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
< 1.23.121.23.12 -
>= 1.24.0, < 1.24.61.24.6
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary workaround, avoid including executable paths in the PATH environment variable. Instead, ensure that only directory paths are present, which can help mitigate the risk of unexpected binaries being returned by LookPath.
Conclusion
The CVE-2025-47906 vulnerability in Golang's LookPath function poses a significant risk by allowing unexpected executables to be returned. It is crucial to update to the patched versions to mitigate this risk and ensure the security of your applications.
See every vulnerability recorded for golang →
FAQ
CVE-2025-47906 is a vulnerability in Golang's LookPath function that can return unexpected executables if the PATH variable contains executable paths.
This vulnerability can lead to the execution of unintended binaries, potentially compromising the security and integrity of your application.
Affected versions include all versions prior to 1.23.12 and 1.24.0 up to 1.24.6.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time. You can check your application using the Vulert playground without any signup.
If an immediate update is not possible, consider removing executable paths from your PATH variable as a temporary workaround.
References
Related vulnerabilities
Recent vulnerabilities recorded for golang.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
