[Cycode] Fix for vulnerable manifest file dependency - go.opentelemetry.io/otel/sdk updated to version 1.33.0

[cycode-security]

Cycode Vulnerable Dependencies Update

This pull request updates the following manifest file:

File Path	Number of packages to update
go.mod	1

📂 go.mod

1 package will be updated to resolve vulnerabilities:

Package Name	Current Version	Updated Version
go.opentelemetry.io/otel/sdk	1.30.0	1.33.0

[cycode-security]

❗Cycode: Security vulnerability found in newly introduced dependency.

Risk Score	77 (HIGH)
Severity	High
Issue	opentelemetry-go: BSD kenv command not using absolute path enables PATH hijacking: CVE-2026-39883
Ecosystem	Go
Dependency	go.opentelemetry.io/otel/sdk
Dependency Paths	go.opentelemetry.io/otel/sdk 1.33.0
Direct Dependency	Yes
Development Dependency	No
Upgrade	1.43.0

Summary

The fix for GHSA-9h8m-3fm2-qjrq (CVE-2026-24051) changed the Darwin ioreg command to use an absolute path but left the BSD kenv command using a bare name, allowing the same PATH hijacking attack on BSD and Solaris platforms.

Root Cause

sdk/resource/host_id.go line 42:

if result, err := r.execCommand("kenv", "-q", "smbios.system.uuid"); err == nil {

Compare with the fixed Darwin path at line 58:

result, err := r.execCommand("/usr/sbin/ioreg", "-rd1", "-c", "IOPlatformExpertDevice")

The execCommand helper at sdk/resource/host_id_exec.go uses exec.Command(name, arg...) which searches $PATH when the command name contains no path separator.

Affected platforms (per build tag in host_id_bsd.go:4): DragonFly BSD, FreeBSD, NetBSD, OpenBSD, Solaris.

The kenv path is reached when /etc/hostid does not exist (line 38-40), which is common on FreeBSD systems.

Attack

1. Attacker has local access to a system running a Go application that imports go.opentelemetry.io/otel/sdk
2. Attacker places a malicious kenv binary earlier in $PATH
3. Application initializes OpenTelemetry resource detection at startup
4. hostIDReaderBSD.read() calls exec.Command("kenv", ...) which resolves to the malicious binary
5. Arbitrary code executes in the context of the application

Same attack vector and impact as CVE-2026-24051.

Suggested Fix

Use the absolute path:

if result, err := r.execCommand("/bin/kenv", "-q", "smbios.system.uuid"); err == nil {

On FreeBSD, kenv is located at /bin/kenv.

Description

Detects when new vulnerabilities affect your dependencies.

Tell us how you wish to proceed using one of the following commands:

Tag	Short Description
#cycode_ignore_manifest_here <reason>	Applies to this manifest in this request only
#cycode_vulnerable_package_fix_this_violation	Fix this violation via a commit to this branch
#cycode_ignore_package_here <reason>	Applies to this manifest for this package in this request only

⚠️ When commenting on Github, you may need to refresh the page to see the latest updates.

[cycode-security]

❗Cycode: Security vulnerability found in newly introduced dependency.

Risk Score	77 (HIGH)
Severity	High
Issue	OpenTelemetry Go SDK Vulnerable to Arbitrary Code Execution via PATH Hijacking: CVE-2026-24051
Ecosystem	Go
Dependency	go.opentelemetry.io/otel/sdk
Dependency Paths	go.opentelemetry.io/otel/sdk 1.33.0
Direct Dependency	Yes
Development Dependency	No
Upgrade	1.40.0

Impact

The OpenTelemetry Go SDK in version v1.20.0-1.39.0 is vulnerable to Path Hijacking (Untrusted Search Paths) on macOS/Darwin systems. The resource detection code in sdk/resource/host_id.go executes the ioreg system command using a search path. An attacker with the ability to locally modify the PATH environment variable can achieve Arbitrary Code Execution (ACE) within the context of the application.

Patches

This has been patched in d45961b, which was released with v1.40.0.

References

• CWE-426: Untrusted Search Path

Description

Detects when new vulnerabilities affect your dependencies.

Tell us how you wish to proceed using one of the following commands:

Tag	Short Description
#cycode_ignore_manifest_here <reason>	Applies to this manifest in this request only
#cycode_vulnerable_package_fix_this_violation	Fix this violation via a commit to this branch
#cycode_ignore_package_here <reason>	Applies to this manifest for this package in this request only

⚠️ When commenting on Github, you may need to refresh the page to see the latest updates.