High · published February 3, 2026
⚡ A sneaky path hijacking vulnerability in OpenTelemetry-Go versions v1.20.0-1.39.0 can lead to arbitrary code execution on macOS — it’s like an invited guest rearranging the entire guest list at a party! 🎉 Think of it like an untrustworthy party planner who decides to change the venue mid-event, allowing unwelcome guests access to all your secrets. If someone can modify the PATH environment variable, they can effectively redirect the application to run malicious code. An attacker could exploit this flaw to execute arbitrary code within your application’s context, potentially gaining unauthorized access to sensitive data or system resources. This could lead to serious data breaches or system compromises that are absolutely devastating!
Think of it like an untrustworthy party planner who decides to change the venue mid-event, allowing unwelcome guests access to all your secrets. If someone can modify the PATH environment variable, they can effectively redirect the application to run malicious code. The vulnerability arises from the OpenTelemetry Go SDK's resource detection code executing the `ioreg` system command without properly validating the search path. As a result, if an attacker alters the PATH variable, they can execute arbitrary commands.
An attacker could exploit this flaw to execute arbitrary code within your application’s context, potentially gaining unauthorized access to sensitive data or system resources. This could lead to serious data breaches or system compromises that are absolutely devastating! To secure your systems, update the OpenTelemetry-Go SDK to version v1.40.0 or later immediately. Additionally, review your PATH environment variable configurations and consider applying restrictions to mitigate future exploitation risks. You've got this! By following these steps, you'll block this vulnerability and keep your applications safe. 🛡️
| Product | Versions | Fixed in |
|---|---|---|
| opentelemetry/opentelemetry | ≥ 1.21.0, < 1.40.0 | 1.40.0 |