CVE-2022-41716: Golang Go

High severity, CVSS 7.5. EPSS: 0.9% chance of exploitation in the next 30 days.

Due to unsanitized NUL values, attackers may be able to maliciously set environment variables on Windows. In syscall.StartProcess and os/exec.Cmd, invalid environment variable values containing NUL values are not properly checked for. A malicious environment variable value can exploit this behavior to set a value for a different environment variable. For example, the environment variable string "A=B\x00C=D" sets the variables "A=B" and "C=D".

Affected products

• Golang Go: before 1.18.8 (fixed in 1.18.8); from 1.19.0, before 1.19.3 (fixed in 1.19.3)

Published 2022-11-02. Last modified 2026-06-17.