—
GO-2026-5426
Opentelemetry-go: BSD kenv command not using absolute path enables PATH hijacking in go.opentelemetry.io/otel/sdk
Quick fix
GO-2026-5426 — go.opentelemetry.io/otel/sdk: upgrade to the fixed version with the command below.
go get go.opentelemetry.io/otel/sdk@v1.43.0Details
Opentelemetry-go: BSD kenv command not using absolute path enables PATH hijacking in go.opentelemetry.io/otel/sdk
Are you affected?
Enter the version of the package you're using.
Affected packages
Go / go.opentelemetry.io/otel/sdk
Introduced in:
1.15.0 Fixed in: 1.43.0 Fix
go get go.opentelemetry.io/otel/sdk@v1.43.0