Advisory Database
  • Advisories
  • Dependency Scanning
  1. golang
  2. ›
  3. github.com/google/fscrypt
  4. ›
  5. CVE-2022-25328

CVE-2022-25328: Command injection in github.com/google/fscrypt

February 26, 2022 (updated March 1, 2022)

The bash_completion script for fscrypt allows injection of commands via crafted mountpoint paths, allowing privilege escalation under a specific set of circumstances. A local user who has control over mountpoint paths could potentially escalate their privileges if they create a malicious mountpoint path and if the system administrator happens to be using the fscrypt bash completion script to complete mountpoint paths. We recommend upgrading to version 0.3.3 or above

References

  • github.com/advisories/GHSA-wxjg-p59j-6c92
  • github.com/google/fscrypt/pull/346
  • nvd.nist.gov/vuln/detail/CVE-2022-25328

Code Behaviors & Features

Detect and mitigate CVE-2022-25328 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →

Affected versions

All versions before 0.3.3

Fixed versions

  • v0.3.3

Solution

Upgrade to version 0.3.3 or above.

Impact 7.3 HIGH

CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

Learn more about CVSS

Source file

go/github.com/google/fscrypt/CVE-2022-25328.yml

Spotted a mistake? Edit the file on GitLab.

  • Site Repo
  • About GitLab
  • Terms
  • Privacy Statement
  • Contact

Page generated Sun, 08 Nov 2026 00:16:32 +0000.