CVE-2025-47906

CVE-2025-47906 refers to a security vulnerability found in Go versions 1.24.6 and 1.23.12. Specifically, it affects the `os/exec` package. The vulnerability arises because the `LookPath` function might return unexpected paths if the PATH environment variable includes paths that are executable files instead of directories. Passing certain strings to LookPath ("", ".", and "..") could lead to the unexpected return of binaries listed in the PATH. Additionally, a separate vulnerability, CVE-2025-47907, was identified in the `database/sql` package. This issue involves incorrect results being returned from `Rows.Scan`. Cancelling a query during a call to the Scan method of the returned Rows can lead to a race condition, potentially overwriting expected results with those from another query if queries are made in parallel. This can cause Scan to return unexpected results or an error and is believed to affect most database/sql drivers.