GHSA-mh68-qf2j-8c5g
GitHub Security Advisory
⚠ Unreviewed
HIGH
Has CVE
Advisory Details
Due to unsanitized NUL values, attackers may be able to maliciously set environment variables on Windows. In syscall.StartProcess and os/exec.Cmd, invalid environment variable values containing NUL values are not properly checked for. A malicious environment variable value can exploit this behavior to set a value for a different environment variable. For example, the environment variable string "A=B\x00C=D" sets the variables "A=B" and "C=D".
Related CVEs
Key Information
7.5
/10
Dataset
Last updated: July 17, 2025 2:40 PM
Data from GitHub Advisory Database. This information is provided for research and educational purposes.