CLEANSTART-2026-GH21889
See a problem?- Import Source
- https://github.com/cleanstart-dev/cleanstart-security-advisories/blob/main/advisories/2026/CLEANSTART-2026-GH21889.json
- JSON Data
- https://api.osv.dev/v1/vulns/CLEANSTART-2026-GH21889
- Upstream
- Published
- 2026-10-31T13:36:08Z
- Modified
- 2026-10-31T16:04:05Z
- Severity
-
- 6.5 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L CVSS Calculator
- Summary
- If the PATH environment variable contains paths which are executables (rather than just directories), passing certain strings to LookPath ("", "
- Details
-
CVE-2025-47906 affects multiple packages. If the PATH environment variable contains paths which are executables (rather than just directories), passing certain strings to LookPath ("", ". See references for individual vulnerability details.
- References
Affected packages
CleanStart / nats-server-fips
Package
- Name
- nats-server-fips
- Purl
- pkg:apk/cleanstart/nats-server-fips
CleanStart / falcosidekick
Package
- Name
- falcosidekick
- Purl
- pkg:apk/cleanstart/falcosidekick