CVE-2025-48069: Exportfunctions Go Cwe 000 Cve 2025 48069
Constructing shell output strings and validating them with a flawed greedy regex pattern allows command injection. The regex uses a greedy `.*` pattern inside single quotes for values, meaning an attacker can craft a key containing an equals sign (`=`) to cause the regex to misidentify the key-value boundary, bypassing validation.
greprules fetch cve-2025-48069-exportfunctions-go-cwe-000-cve-2025-48069 --engine opengrepDescription
Constructing shell output strings and validating them with a flawed greedy regex pattern allows command injection. The regex uses a greedy `.*` pattern inside single quotes for values, meaning an attacker can craft a key containing an equals sign (`=`) to cause the regex to misidentify the key-value boundary, bypassing validation.
Detection target
Not provided
Recommended fix
Not provided
False-positive notes
Not provided
Community feedback
Sign in to report false positives, mark this rule useful, or suggest metadata improvements.