GCVE-110-VULN-GO-2026-000287

Advisory PublishedCVSS 4.2/10

Vulnetix · Advisory published October 18, 2026

[GO-SYSCALL-EXEC] syscall.Exec/ForkExec direct process replacement/spawn — matched: if err := syscall.Exec(bin, target, os.Environ()); err != nil { //nolint:gosec // the command is what the user asked to run

Download JSON Open in Console

Weaknesses (CWE)

CWE-78Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

Risk Scores

CVSS 3.1

4.2/10

Medium · CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:L

Affected Products

Vendor	Product	Versions	Platforms
go	github.com/justenwalker/kevin	0.0.7 (affected)	—

References

advisory

web

Browse GCVE Records

3,026 records in the GCVE database · Updated October 19, 2026

No matching records found.

Explore Further

Investigate this vulnerability in the interactive console or download the raw GCVE record.

Open in Console Download JSON