{"id":"CLEANSTART-2026-GH21889","summary":"If the PATH environment variable contains paths which are executables (rather than just directories), passing certain strings to LookPath (\"\", \"","details":"CVE-2025-47906 affects multiple packages. If the PATH environment variable contains paths which are executables (rather than just directories), passing certain strings to LookPath (\"\", \". See references for individual vulnerability details.","modified":"2026-10-31T16:04:05.428387416Z","published":"2026-10-31T13:36:08.822291Z","upstream":["CVE-2025-47906"],"database_specific":{},"references":[{"type":"ADVISORY","url":"https://github.com/cleanstart-dev/cleanstart-security-advisories/tree/main/advisories/2026/CLEANSTART-2026-GH21889.json"},{"type":"WEB","url":"https://osv.dev/vulnerability/CVE-2025-47906"},{"type":"WEB","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-47906"}],"affected":[{"package":{"name":"nats-server-fips","ecosystem":"CleanStart","purl":"pkg:apk/cleanstart/nats-server-fips"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.9.25-r1"}]}],"database_specific":{"source":"https://github.com/cleanstart-dev/cleanstart-security-advisories/blob/main/advisories/2026/CLEANSTART-2026-GH21889.json"}},{"package":{"name":"falcosidekick","ecosystem":"CleanStart","purl":"pkg:apk/cleanstart/falcosidekick"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.32.0-r0"}]}],"database_specific":{"source":"https://github.com/cleanstart-dev/cleanstart-security-advisories/blob/main/advisories/2026/CLEANSTART-2026-GH21889.json"}},{"package":{"name":"falcosidekick-fips","ecosystem":"CleanStart","purl":"pkg:apk/cleanstart/falcosidekick-fips"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.32.0-r0"}]}],"database_specific":{"source":"https://github.com/cleanstart-dev/cleanstart-security-advisories/blob/main/advisories/2026/CLEANSTART-2026-GH21889.json"}}],"schema_version":"1.9.2","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L"}]}