https://db.gcve.eu/rss/recent/all/10 Most recent entries from all 2026-10-07T12:35:42.722628+00:00 Vulnerability-Lookup info@gcve.eu python-feedgen Contains only the most 10 recent entries. https://db.gcve.eu/vuln/cleanstart-2026-ws51251 CLEANSTART-2026-WS51251 — Security fix for ghsa-9h8m-3fm2-qjrq applied in: buildkitd 0.26.3-r1, containerd 2.1.3-r2, cosign 3.0.5-r0 2026-10-07T12:35:42.739936+00:00

Affected: CleanStart: buildkitd, CleanStart: containerd, CleanStart: cosign

ghsa-9h8m-3fm2-qjrq affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details.

 https://db.gcve.eu/vuln/ghsa-9h8m-3fm2-qjrq GHSA-9h8m-3fm2-qjrq — OpenTelemetry Go SDK Vulnerable to Arbitrary Code Execution via PATH Hijacking 2026-10-07T12:35:42.740517+00:00

Affected: Go: go.opentelemetry.io/otel/sdk

### Impact The OpenTelemetry Go SDK in version `v1.20.0`-`1.39.0` is vulnerable to Path Hijacking (Untrusted Search Paths) on macOS/Darwin systems. The resource detection code in `sdk/resource/host_id.go` executes the `ioreg` system command using a search path. An attacker with the ability to locally modify the PATH environment variable can achieve Arbitrary Code Execution (ACE) within the context of the application.

### Patches This has been patched in [d45961b](https://github.com/open-telemetry/opentelemetry-go/commit/d45961bcda453fcbdb6469c22d6e88a1f9970a53), which was released with `v1.40.0`.

### References - [CWE-426: Untrusted Search Path](https://cwe.mitre.org/data/definitions/426.html)