CVE-2026-24051 — OpenTelemetry-Go Affected by Arbitrary Code Execution via PATH Hijacking

Affected: open-telemetry opentelemetry-go

OpenTelemetry-Go is the Go implementation of OpenTelemetry. The OpenTelemetry Go SDK in version v1.20.0-1.39.0 is vulnerable to Path Hijacking (Untrusted Search Paths) on macOS/Darwin systems. The resource detection code in sdk/resource/host_id.go executes the ioreg system command using a search path. An attacker with the ability to locally modify the PATH environment variable can achieve Arbitrary Code Execution (ACE) within the context of the application. A fix was released with v1.40.0.

GHSA-fw7p-63qq-7hpr — filippo.io/edwards25519 MultiScalarMult produces invalid results or undefined behavior if receiver is not the identity

Affected: Go: filippo.io/edwards25519

`(*Point).MultiScalarMult` failed to initialize its receiver.

If the method was called on an initialized point that is not the identity point, MultiScalarMult produced an incorrect result.

If the method was called on an uninitialized point, the behavior was undefined. In particular, if the receiver was the zero value, MultiScalarMult returned an invalid point that compared Equal to every point.

*Note that MultiScalarMult is a rarely used advanced API. For example, if you only depend on `filippo.io/edwards25519` via `github.com/go-sql-driver/mysql`, **you are not affected**. If you were notified of this issue despite not being affected, consider switching to a vulnerability scanner that is more precise and respectful of your attention, like [govulncheck](https://go.dev/doc/tutorial/govulncheck).*

Most recent entries from all

CVE-2026-24051 — OpenTelemetry-Go Affected by Arbitrary Code Execution via PATH Hijacking

GHSA-fw7p-63qq-7hpr — filippo.io/edwards25519 MultiScalarMult produces invalid results or undefined behavior if receiver is not the identity