GHSA-32gq-x56h-299c
age vulnerable to malicious plugin names, recipients, or identities causing arbitrary binary execution
GHSA-32gq-x56h-299c is a vulnerability with no CVSS score yet in filippo.io/age, published December 18, 2024. No source lists public exploit code. Fixed in filippo.io/age 1.2.1.
- Severity
- UnratedNo CVSS score yet
- Exploit chance
- UnscoredNo EPSS score yet
- Exploitation
- None knownNot on CISA’s or ENISA’s lists
- Fixed in
1.2.1filippo.io/age
Description
A plugin name containing a path separator may allow an attacker to execute an arbitrary binary.
Such a plugin name can be provided to the age CLI through an attacker-controlled recipient or identity string, or to the plugin.NewIdentity, plugin.NewIdentityWithoutData, or plugin.NewRecipient APIs.
On UNIX systems, a directory matching ${TMPDIR:-/tmp}/age-plugin-* needs to exist for the attack to succeed.
The binary is executed with a single flag, either --age-plugin=recipient-v1 or --age-plugin=identity-v1. The standard input includes the recipient or identity string, and the random file key (if encrypting) or the header of the file (if decrypting). The format is constrained by the age-plugin protocol.
An equivalent issue was fixed by the rage project, see advisory GHSA-4fg7-vxc8-qx5w.
Thanks to ⬡-49016 for reporting this.
Affected packages
| Package | Affected | Fixed |
|---|---|---|
filippo.io/ageGo | before 1.2.1 | 1.2.1 |
What each source reports
GitHub AdvisoriesNo score
age vulnerable to malicious plugin names, recipients, or identities causing arbitrary binary execution
A plugin name containing a path separator may allow an attacker to execute an arbitrary binary.
Such a plugin name can be provided to the age CLI through an attacker-controlled recipient or identity string, or to the plugin.NewIdentity, plugin.NewIdentityWithoutData, or plugin.NewRecipient APIs.
On UNIX systems, a directory matching ${TMPDIR:-/tmp}/age-plugin-* needs to exist for the attack to succeed.
The binary is executed with a single flag, either --age-plugin=recipient-v1 or --age-plugin=identity-v1. The standard input includes the recipient or identity string, and the random file key (if encrypting) or the header of the file (if decrypting). The format is constrained by the age-plugin protocol.
An equivalent issue was fixed by the rage project, see advisory GHSA-4fg7-vxc8-qx5w.
Thanks to ⬡-49016 for reporting this.
- Record
GHSA-32gq-x56h-299c- Weakness
- CWE-25
- Updated
- 2026-11-02
OSVNo score
age vulnerable to malicious plugin names, recipients, or identities causing arbitrary binary execution
A plugin name containing a path separator may allow an attacker to execute an arbitrary binary.
Such a plugin name can be provided to the age CLI through an attacker-controlled recipient or identity string, or to the plugin.NewIdentity, plugin.NewIdentityWithoutData, or plugin.NewRecipient APIs.
On UNIX systems, a directory matching ${TMPDIR:-/tmp}/age-plugin-* needs to exist for the attack to succeed.
The binary is executed with a single flag, either --age-plugin=recipient-v1 or --age-plugin=identity-v1. The standard input includes the recipient or identity string, and the random file key (if encrypting) or the header of the file (if decrypting). The format is constrained by the age-plugin protocol.
An equivalent issue was fixed by the rage project, see advisory GHSA-4fg7-vxc8-qx5w.
Thanks to ⬡-49016 for reporting this.
- Record
GHSA-32gq-x56h-299c- Weakness
- CWE-25
- Updated
- 2026-11-02
OSVGO-2024-3344No score
Malicious plugin names, recipients, or identities causing arbitrary binary execution in filippo.io/age
Malicious plugin names, recipients, or identities causing arbitrary binary execution in filippo.io/age
- Record
GO-2024-3344- Updated
- 2026-11-02
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | GitHub Advisories, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.