{
  "affected": [
    {
      "package": {
        "ecosystem": "Go",
        "name": "filippo.io/age"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.2.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [],
  "database_specific": {
    "cwe_ids": [
      "CWE-25"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2024-12-18T18:23:06Z",
    "nvd_published_at": null,
    "severity": "MODERATE"
  },
  "details": "A plugin name containing a path separator may allow an attacker to execute an arbitrary binary.\n\nSuch a plugin name can be provided to the age CLI through an attacker-controlled recipient or identity string, or to the [`plugin.NewIdentity`](https://pkg.go.dev/filippo.io/age/plugin#NewIdentity), [`plugin.NewIdentityWithoutData`](https://pkg.go.dev/filippo.io/age/plugin#NewIdentityWithoutData), or [`plugin.NewRecipient`](https://pkg.go.dev/filippo.io/age/plugin#NewRecipient) APIs.\n\nOn UNIX systems, a directory matching `${TMPDIR:-/tmp}/age-plugin-*` needs to exist for the attack to succeed.\n\nThe binary is executed with a single flag, either `--age-plugin=recipient-v1` or `--age-plugin=identity-v1`. The standard input includes the recipient or identity string, and the random file key (if encrypting) or the header of the file (if decrypting). The format is constrained by the [age-plugin](https://c2sp.org/age-plugin) protocol.\n\nAn equivalent issue was fixed by the [rage](https://github.com/str4d/rage) project, see advisory [GHSA-4fg7-vxc8-qx5w](https://github.com/str4d/rage/security/advisories/GHSA-4fg7-vxc8-qx5w).\n\nThanks to \u2b21-49016 for reporting this.",
  "id": "GHSA-32gq-x56h-299c",
  "modified": "2024-12-20T21:41:09Z",
  "published": "2024-12-18T18:23:06Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/FiloSottile/age/security/advisories/GHSA-32gq-x56h-299c"
    },
    {
      "type": "WEB",
      "url": "https://github.com/str4d/rage/security/advisories/GHSA-4fg7-vxc8-qx5w"
    },
    {
      "type": "WEB",
      "url": "https://github.com/FiloSottile/age/commit/482cf6fc9babd3ab06f6606762aac10447222201"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/FiloSottile/age"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [],
  "summary": "age vulnerable to malicious plugin names, recipients, or identities causing arbitrary binary execution"
}