CVE-2025-47906: Go stdlib os/exec LookPath Unexpected Path Return Vulnerability
Summary
CVE-2025-47906: Unexpected paths returned from LookPath in os/exec. Affects stdlib across 2 version ranges.
< 1.23.12
>= 1.24.0, < 1.24.6
Fixed in 1.23.12 or 1.24.6, depending on the release line you run. How to fix ↓
Also tracked for
- golang · Bitnami
- golang-1.15 · Debian:11
The same CVE-2025-47906 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Go standard library (stdlib) is a collection of packages that provide essential functionalities for Go programming. Among these, the 'os/exec' package allows for the execution of external commands. This package is widely used for running system commands and managing processes. However, it is susceptible to a vulnerability that can lead to unexpected behavior when resolving executable paths.
Vulnerability Detail
The vulnerability arises from the behavior of the LookPath function in the os/exec package. If the PATH environment variable includes paths that are executable files instead of just directories, certain inputs to LookPath (specifically the strings '', '.', and '..') can lead to these executables being returned unexpectedly. This can result in security risks, such as executing unintended binaries, which can compromise the integrity of the application and the system it runs on.
How To Fix
Latest published version: go1.25.5 as of 22 Oct 2026
go get stdlib@vgo1.25.5Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
< 1.23.121.23.12go get stdlib@v1.23.12 -
>= 1.24.0, < 1.24.61.24.6go get stdlib@v1.24.6
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary workaround, avoid using the LookPath function with the strings '', '.', and '..' in environments where the PATH variable contains executable files. Instead, specify absolute paths to the executables you intend to run.
Conclusion
The CVE-2025-47906 vulnerability in the Go standard library's os/exec package poses a significant risk due to unexpected path resolutions in the LookPath function. It is crucial to update to the patched versions or implement workarounds to mitigate potential security threats.
See every vulnerability recorded for stdlib →
FAQ
CVE-2025-47906 is a vulnerability in the Go standard library's os/exec package that can lead to unexpected executables being returned by the LookPath function.
If your application uses the LookPath function and the PATH variable is improperly configured, it may execute unintended binaries, leading to potential security risks.
The vulnerability affects Go versions prior to 1.23.12 and 1.24.6. Updating to these versions will resolve the issue.
You can use Vulert, which monitors open-source vulnerabilities in real-time. Visit Vulert Scanner to check if your application is affected without needing to sign up.
If an immediate update is not possible, implement the recommended workaround by avoiding the use of LookPath with certain strings and specifying absolute paths instead.
References
Related vulnerabilities
Recent vulnerabilities recorded for stdlib.
