GHSA-9h8m-3fm2-qjrq: OpenTelemetry Go SDK Vulnerable to Arbitrary Code Execution via PATH Hijacking

GHSA-9h8m-3fm2-qjrq PUBLISHED CVSS 7 HIGH

OpenTelemetry Go SDK Vulnerable to Arbitrary Code Execution via PATH Hijacking

Record from GitHub Advisory Database · Published February 2, 2026

OpenTelemetry Go SDK Vulnerable to Arbitrary Code Execution via PATH Hijacking

Fixed versions

Upgrade to a fixed version or later. Language registries are listed first, then Linux distributions, then vendor products.

Package	Ecosystem	Fixed in
istio-1.28	Wolfi	1.28.4-r2
istio-1.29	Chainguard	1.29.0-r1
tflint	Chainguard	0.61.0-r1
dgraph	Wolfi	25.2.0-r4
kubevirt-cdi-controller-1.6	Chainguard	1.66.0-r1
dkron	Chainguard	4.0.9-r3
kine	Wolfi	0.14.12-r2
grafana-pyroscope-1.18	Chainguard	1.18.1-r1
hydra	Wolfi	25.4.0-r7
kyverno-1.16	Chainguard	1.16.3-r7
prometheus-mongodb-exporter	Chainguard	0.49.0-r1
kiali	Wolfi	2.22.0-r1

88 more packages have a fixed version. See every fix in Lookup.

Risk scores

CVSS 3.1

CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Affected products

Vendor	Product	Versions
wolfi	istio-1.28	0
chainguard	cosign-fips	*
chainguard	istio-1.29	0
chainguard	tflint	0
wolfi	dgraph	0
chainguard	kubevirt-cdi-controller-1.6	0
chainguard	flux-kustomize-controller	*
chainguard	dkron	0
wolfi	kine	0
chainguard	knative-operator-1.21	*
chainguard	knative-operator-fips-1.19	*
chainguard	grafana-pyroscope-1.18	0
wolfi	hydra	0
chainguard	cluster-autoscaler-fips-1.31	*
chainguard	kyverno-1.16	0
chainguard	prometheus-mongodb-exporter	0
wolfi	kiali	0
wolfi	dapr-1.15	*
chainguard	knative-eventing-1.21	*
chainguard	argo-cd-fips-3.2	0

…and 1064 more

Timeline

Feb 2, 2026 CVE Published
Apr 9, 2026 Security Advisory

Query this with the API

The same record, from the CLI:

vulnetix vdb vuln GHSA-9h8m-3fm2-qjrq
vulnetix vdb fixes GHSA-9h8m-3fm2-qjrq

Or with curl, using the org id and key from your account page:

curl -s -H "Authorization: ApiKey ${VULNETIX_ORG_ID}:${VULNETIX_API_KEY}" \
  "https://api.vdb.vulnetix.com/v2/vuln/GHSA-9h8m-3fm2-qjrq/fixes/registry"

The Community plan is free and allows 50 queries a day. Get a free API key · API quickstart

References

Look up in the Resolve Platform →