How severe is GHSA-c8g6-qrwh-m3vp?

GHSA-c8g6-qrwh-m3vp has a CVSS score of 9.9/10, rated CRITICAL. Immediate patching is strongly recommended.

Which packages are affected by GHSA-c8g6-qrwh-m3vp?

GHSA-c8g6-qrwh-m3vp affects the following packages: github.com/neuvector/neuvector (Go), github.com/neuvector/neuvector (Go), github.com/neuvector/neuvector (Go). Ecosystems affected: Go.

How do I fix GHSA-c8g6-qrwh-m3vp?

Update github.com/neuvector/neuvector to 5.3.5 or later, then make sure no transitive (indirect) dependency still pins the vulnerable range — O3 confirms GHSA-c8g6-qrwh-m3vp is resolved across your whole dependency graph.

How do I detect GHSA-c8g6-qrwh-m3vp in my Go dependencies?

Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for github.com/neuvector/neuvector. O3's reachability analysis confirms whether the vulnerable code path is actually invoked in your application, so you act on real exposure instead of every transitive match.

How do I mitigate GHSA-c8g6-qrwh-m3vp if there is no patch (or I can't update yet)?

If you can't upgrade right away: gate or disable the affected feature, validate untrusted input at the boundary, and avoid passing attacker-controlled data into the vulnerable path. O3's runtime protection blocks exploitation in production as an interim safeguard until the upgrade lands.

How does O3 Security protect against GHSA-c8g6-qrwh-m3vp?

O3 pinpoints whether GHSA-c8g6-qrwh-m3vp is reachable in your code and exactly where to fix it, then blocks exploitation in production at runtime until the patched version is deployed.

Is GHSA-c8g6-qrwh-m3vp actively exploited in the wild?

No public exploit code has been indexed for GHSA-c8g6-qrwh-m3vp yet. This does not mean the vulnerability cannot be exploited — absence of public exploits does not imply safety. Apply the recommended fix and use O3 Security to monitor your exposure.

What type of vulnerability is GHSA-c8g6-qrwh-m3vp?

GHSA-c8g6-qrwh-m3vp is classified as OS Command Injection (CWE-78). This weakness type describe the underlying flaw category, which helps determine the potential impact and the right class of mitigation. This is a high-impact weakness class that often enables remote code execution or data exposure.

When was GHSA-c8g6-qrwh-m3vp published, and has it been updated?

GHSA-c8g6-qrwh-m3vp was published on October 21, 2025 and was last updated on February 4, 2026. Advisory data evolves as severity scores, affected ranges, and exploit intelligence are revised — always check the latest version of the advisory before acting.

🐹 Go

GHSA-c8g6-qrwh-m3vp

CRITICAL

GHSA-c8g6-qrwh-m3vp is a critical-severity (CVSS 9.9) OS Command Injection vulnerability in github.com/neuvector/neuvector. O3 Security confirms whether GHSA-c8g6-qrwh-m3vp is actually reachable in your code before you act, and blocks exploitation at runtime until you patch.

NeuVector Enforcer is vulnerable to Command Injection and Buffer overflow

Also known asCVE-2025-54469GO-2025-4042

Published

Oct 21, 2025

Updated

Feb 4, 2026

Affected

3 pkgs

Patched

3 / 3

Exploits

None indexed

Real-World Exposure

3 pkgs affected

🐹github.com/neuvector/neuvector🐹github.com/neuvector/neuvector🐹github.com/neuvector/neuvector

Real-time download stats are indexed for npm and PyPI packages. This vulnerability affects Go packages — download data is not available via public APIs for these ecosystems.

Description

Impact

A vulnerability was identified in NeuVector, where the enforcer used environment variables CLUSTER_RPC_PORT and CLUSTER_LAN_PORT to generate a command to be executed via popen, without first sanitising their values.

The entry process of the enforcer container is the monitor process. When the enforcer container stops, the monitor process checks whether the consul subprocess has exited. To perform this check, the monitor process uses the popen function to execute a shell command that determines whether the ports used by the consul subprocess are still active.

The values of environment variables CLUSTER_RPC_PORT and CLUSTER_LAN_PORT are used directly to compose shell commands via popen without validation or sanitization. This behavior could allow a malicious user to inject malicious commands through these variables within the enforcer container.

In the patched version, the monitor process validates the values of CLUSTER_RPC_PORT and CLUSTER_LAN_PORT to ensure they contain only valid port numbers before invoking the popen command.

If validation fails, the monitor process exits immediately, causing the enforcer container to terminate. This prevents the execution of any injected or malicious commands.

Patches

Patched versions include release v5.4.7 and above.

Workarounds

There is no workaround for this issue. Users are recommended to upgrade, as soon as possible, to a version of NeuVector that contains the fix.

References

If you have any questions or comments about this advisory:

Reach out to the SUSE Rancher Security team for security related inquiries.
Open an issue in the NeuVector repository.
Verify with our support matrix and product support lifecycle.

Affected Packages

3 total 3 fixed

Ecosystem	Package	Vulnerable range	Fix
🐹Go	`github.com/neuvector/neuvector`	≥ 5.3.0&&< 5.3.5	5.3.5
🐹Go	`github.com/neuvector/neuvector`	≥ 5.4.0&&< 5.4.7	5.4.7
🐹Go	`github.com/neuvector/neuvector`	≥ 0.0.0-20230727023453-1c4957d53911&&< 0.0.0-20251020133207-084a437033b4	0.0.0-20251020133207-084a437033b4

Detection & mitigation playbook

Open-source dependency

Detect
Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for github.com/neuvector/neuvector. O3's reachability analysis confirms whether the vulnerable code path is actually invoked in your application, so you act on real exposure instead of every transitive match.
Fix
Update github.com/neuvector/neuvector to 5.3.5 or later, then make sure no transitive (indirect) dependency still pins the vulnerable range — O3 confirms GHSA-c8g6-qrwh-m3vp is resolved across your whole dependency graph.
Workarounds
If you can't upgrade right away: gate or disable the affected feature, validate untrusted input at the boundary, and avoid passing attacker-controlled data into the vulnerable path. O3's runtime protection blocks exploitation in production as an interim safeguard until the upgrade lands.
How O3 protects you
O3 pinpoints whether GHSA-c8g6-qrwh-m3vp is reachable in your code and exactly where to fix it, then blocks exploitation in production at runtime until the patched version is deployed.

Tailored to GHSA-c8g6-qrwh-m3vp. Runtime protection reduces exposure until a permanent patch is applied and verified — it complements patching, it doesn't replace it.

Frequently Asked Questions

### Impact A vulnerability was identified in NeuVector, where the enforcer used environment variables `CLUSTER_RPC_PORT` and `CLUSTER_LAN_PORT` to generate a command to be executed via `popen`, without first sanitising their values. The entry process of the enforcer container is the monitor process. When the enforcer container stops, the monitor process checks whether the consul subprocess has exited. To perform this check, the monitor process uses the `popen` function to execute a shell command that determines whether the ports used by the consul subprocess are still active. The values of e

O3 Security · Impact-Aware SCA

Is GHSA-c8g6-qrwh-m3vp in your dependencies?

O3 detects GHSA-c8g6-qrwh-m3vp across Go dependencies and uses function-level reachability to confirm whether the vulnerable code path is actually reachable — not just present. No false positives.

Scan my dependencies How O3 SCA works

GHSA-c8g6-qrwh-m3vp

Real-World Exposure

Description

Impact

Patches

Workarounds

References

Affected Packages

Detection & mitigation playbook

Detect

Fix

Workarounds

How O3 protects you

Frequently Asked Questions

Is GHSA-c8g6-qrwh-m3vp in your dependencies?