OpenTelemetry-Go Path Hijacking Vulnerability Leading to Arbitrary Code Execution on macOS

A path hijacking vulnerability allowing arbitrary code execution has been identified in the OpenTelemetry Go SDK, specifically in versions 1.20.0 prior to 1.39.0. This issue arises on macOS systems, where the resource detection code executes the 'ioreg' command using a search path. An attacker who can locally modify the PATH environment variable could exploit this vulnerability to execute arbitrary code within the application's context.

Impact

Exploitation of this vulnerability could lead to arbitrary code execution within the context of the application.

Remediation

Users can upgrade to OpenTelemetry Go SDK version 1.40.0 or later to address this vulnerability.