Description
Due to unsanitized NUL values, attackers may be able to maliciously set environment variables on Windows. In syscall.StartProcess and os/exec.Cmd, invalid environment variable values containing NUL values are not properly checked for. A malicious environment variable value can exploit this behavior to set a value for a different environment variable. For example, the environment variable string "A=B\x00C=D" sets the variables "A=B" and "C=D".
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Go standard library syscall
Default version status: unaffected
0 to < 1.18.8affected1.19.0-0 to < 1.19.3affected
Go standard library os/exec
Default version status: unaffected
0 to < 1.18.8affected1.19.0-0 to < 1.19.3affected