AI Sec Watch: A Security Intelligence Platform for AI Systems

Luu, T.J.

GHSA-v8pv-4842-x354: OpenTelemetry.Resources.Host vulnerable to arbitrary code execution via local PATH hijacking on macOS

highvulnerability

security

Source: GitHub Advisory DatabaseSeptember 16, 2026CVE-2026-81192

Summary

The OpenTelemetry.Resources.Host NuGet package on macOS has a vulnerability where it launches programs using bare names instead of absolute paths, allowing a less-privileged attacker to hijack the PATH environment variable (the list of directories the system searches for programs) and execute malicious code with the application's permissions. This vulnerability does not affect Linux or Windows systems.

Solution / Mitigation

The vulnerability was fixed by pull request open-telemetry/opentelemetry-dotnet-contrib#4760, which executes `ioreg` directly using its absolute path instead of relying on the PATH environment variable.