The vulnerability in OpenTelemetry-Go allows an attacker who can locally influence the PATH environment variable to cause the SDK to execute a malicious executable instead of the intended system command. This results in arbitrary code execution in the context of any application that imports the affected SDK, compromising confidentiality, integrity, and availability of that application. The weakness is identified as CWE-426, Untrusted Search Path.

This flaw affects the OpenTelemetry-Go SDK for macOS/Darwin distributed under the Linux Foundation – OpenTelemetry organization. Versions from v1.20.0 through v1.39.0 inclusive are impacted. Applications on other operating systems or later SDK releases are not affected.

The CVSS score of 7.0 indicates a high severity, while the EPSS result of <1% suggests a low probability of exploitation at the current time. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. An attacker must be able to alter the PATH for the user running the application, a scenario likely involving local compromise or a compromised user account. If the application runs with elevated privileges, the impact could be system‑wide. The issue is mitigated in v1.40.0 and later revisions.