{"id":"GHSA-x5c7-x7m2-rhmf","aliases":["GO-2022-0410"],"status":"published","title":"Local directory executable lookup in sops (Windows-only)","description":"### Impact\nWindows users using the sops direct editor option (`sops file.yaml`) can have a local executable named either `vi`, `vim`, or `nano` executed if running sops from `cmd.exe`\n\nThis attack is only viable if an attacker is able to place a malicious binary within the directory you are running sops from. As well, this attack will only work when using `cmd.exe` or the Windows C library [SearchPath function](https://docs.microsoft.com/en-us/windows/win32/api/processenv/nf-processenv-searchpatha). This is a result of these Windows tools including `.` within their `PATH` by default.\n\n**If you are using sops within untrusted directories on Windows via `cmd.exe`, please upgrade immediately** \n\n**As well, if you have `.` within your default $PATH, please upgrade immediately.**\n\nMore information can be found on the official Go blog: https://blog.golang.org/path-security\n\n### Patches\nThe problem has been resolved in v3.7.1\n\nNow, if Windows users using cmd.exe run into this issue, a warning message will be printed:\n`vim resolves to executable in current directory (.\\vim.exe)`\n\n### References\n* https://blog.golang.org/path-security\n\n### For more information\nIf you have any questions or comments about this advisory:\n* Open a discussion in [sops](https://github.com/mozilla/sops/discussions)","facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"published":"2021-05-20T16:50:34Z","modified":"2026-03-03T04:52:10Z","fixes":[{"ecosystem":"Go","package":"go.mozilla.org/sops/v3","fixed_in":["3.7.1"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"Go","package":"go.mozilla.org/sops/v3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.7.1"}]}]},{"source":"osv","ecosystem":"Go","package":"go.mozilla.org/sops/v3","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"3.7.1"}]}]},{"source":"osv","ecosystem":"Go","package":"go.mozilla.org/sops","ranges":[{"type":"SEMVER","events":[{"introduced":"0"}]}]},{"source":"osv","ecosystem":"Go","package":"go.mozilla.org/sops/v3","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"3.7.1"}]}]}],"references":[{"url":"https://github.com/mozilla/sops/security/advisories/GHSA-x5c7-x7m2-rhmf","tags":["web","advisory"]},{"url":"https://github.com/advisories/GHSA-x5c7-x7m2-rhmf"}],"sources":{"ghsa":[{"id":"GHSA-x5c7-x7m2-rhmf","title":"Local directory executable lookup in sops (Windows-only)","description":"### Impact\nWindows users using the sops direct editor option (`sops file.yaml`) can have a local executable named either `vi`, `vim`, or `nano` executed if running sops from `cmd.exe`\n\nThis attack is only viable if an attacker is able to place a malicious binary within the directory you are running sops from. As well, this attack will only work when using `cmd.exe` or the Windows C library [SearchPath function](https://docs.microsoft.com/en-us/windows/win32/api/processenv/nf-processenv-searchpatha). This is a result of these Windows tools including `.` within their `PATH` by default.\n\n**If you are using sops within untrusted directories on Windows via `cmd.exe`, please upgrade immediately** \n\n**As well, if you have `.` within your default $PATH, please upgrade immediately.**\n\nMore information can be found on the official Go blog: https://blog.golang.org/path-security\n\n### Patches\nThe problem has been resolved in v3.7.1\n\nNow, if Windows users using cmd.exe run into this issue, a warning message will be printed:\n`vim resolves to executable in current directory (.\\vim.exe)`\n\n### References\n* https://blog.golang.org/path-security\n\n### For more information\nIf you have any questions or comments about this advisory:\n* Open a discussion in [sops](https://github.com/mozilla/sops/discussions)","status":"published","published":"2021-05-20T16:50:34Z","modified":"2023-01-09T05:05:16Z","updated_at":"2026-11-02T14:36:11.367194Z"}],"osv":[{"id":"GHSA-x5c7-x7m2-rhmf","title":"Local directory executable lookup in sops (Windows-only)","description":"### Impact\nWindows users using the sops direct editor option (`sops file.yaml`) can have a local executable named either `vi`, `vim`, or `nano` executed if running sops from `cmd.exe`\n\nThis attack is only viable if an attacker is able to place a malicious binary within the directory you are running sops from. As well, this attack will only work when using `cmd.exe` or the Windows C library [SearchPath function](https://docs.microsoft.com/en-us/windows/win32/api/processenv/nf-processenv-searchpatha). This is a result of these Windows tools including `.` within their `PATH` by default.\n\n**If you are using sops within untrusted directories on Windows via `cmd.exe`, please upgrade immediately** \n\n**As well, if you have `.` within your default $PATH, please upgrade immediately.**\n\nMore information can be found on the official Go blog: https://blog.golang.org/path-security\n\n### Patches\nThe problem has been resolved in v3.7.1\n\nNow, if Windows users using cmd.exe run into this issue, a warning message will be printed:\n`vim resolves to executable in current directory (.\\vim.exe)`\n\n### References\n* https://blog.golang.org/path-security\n\n### For more information\nIf you have any questions or comments about this advisory:\n* Open a discussion in [sops](https://github.com/mozilla/sops/discussions)","status":"published","published":"2021-05-20T16:50:34Z","modified":"2024-08-21T15:42:05.145523Z","updated_at":"2026-11-02T15:46:59.484835Z"},{"id":"GO-2022-0410","title":"Local directory executable lookup in sops (Windows-only) in go.mozilla.org/sops","description":"Local directory executable lookup in sops (Windows-only) in go.mozilla.org/sops","status":"published","published":"2024-08-21T15:11:31Z","modified":"2026-03-03T04:52:10.110956Z","updated_at":"2026-11-02T15:47:00.918515Z"}]}}