OpenTelemetry.Resources.Host macOS Vulnerability: Early Warning
- Severity
- HIGH
- Affected component
- opentelemetry.resources.host (nuget)
- Affected versions
- < 1.16.0-beta.2
- Patched version
- Not yet available
An early warning has been issued regarding a potential untrusted search path vulnerability in the OpenTelemetry.Resources.Host NuGet package on macOS. This vulnerability could allow an attacker to execute arbitrary code.
What happened
An untrusted search path vulnerability has been reported in the OpenTelemetry.Resources.Host NuGet package on macOS. This vulnerability, tracked as GHSA-V8PV-4842-X354, allows an attacker to execute arbitrary code by placing a malicious ioreg executable in the system's PATH. The vulnerability is under investigation and has not yet been exploited in the wild. The affected versions are those prior to 1.16.0-beta.2.
The vulnerability arises because the package does not use absolute paths when invoking ioreg and sh. This allows an attacker to hijack the PATH environment variable and execute arbitrary code in the context of the application. The issue was first flagged on 2026-09-16T13:54:16+00:00.
What to do about it
- Upgrade to the latest version of OpenTelemetry.Resources.Host that uses absolute paths for ioreg and sh.
- Ensure that your system's PATH environment variable is secure and does not include untrusted directories.
- Monitor the official sources for updates on the vulnerability and any patches that may be released.
- Consider implementing additional security measures to protect against local PATH hijacking attacks.
How 0Day would have caught this
opentelemetry.resources.host is anywhere in your dependency tree, the engineers who own the affected repositories get a push alert the moment it is flagged — no manual audit to remember to run.Read how this differs from waiting on a scanner to catch a known advisory, or see the exact, read-only access 0Day needs to do this for an organization.
Frequently asked questions
Am I affected?
You are affected if you are using a version of OpenTelemetry.Resources.Host prior to 1.16.0-beta.2 on macOS.
What should I do right now?
Upgrade to the latest version of OpenTelemetry.Resources.Host that uses absolute paths for ioreg and sh. Ensure your system's PATH environment variable is secure.
Has this been exploited in the wild?
No, this vulnerability has not been reported as exploited in the wild.