# Untrusted path to executable load

Bare command names, sentinel filenames, or file-format paths that resolve to code execution

_Area: Memory corruption and native code. Seen in 3 disclosed reports; 2 confirmed bounties: $750 and $20,000; latest 2023-11-23. Updated 2026-10-23._

## How it works
Code needs to find a program, script, or config file to run or load, but the path it uses is not fixed. It comes from PATH, the current working directory, a config value, or a placeholder string. The assumption that breaks: the code assumes the name it passes resolves to the intended trusted file. In reality the resolver (PATH search, CWD-relative open, or a sentinel string treated as a real name) can point at something an attacker controls, and that thing gets executed or loaded with the caller's privileges.

## Where it shows up
- `exec.Command`/`os.system`/`subprocess` calls with bare binary names (`ifconfig`, `route`, `netsh`) in a process that runs as root or a service account [E2](https://bugbountylibrary.com/r/h1%3A784714.md)
- Handle/state duplication APIs that serialize unset fields as sentinel strings like `none`, later read back as real filenames [E3](https://bugbountylibrary.com/r/h1%3A2215578.md)
- File-open handlers that deserialize and execute embedded scripts, where auth is applied per file extension rather than in the shared parser [E1](https://bugbountylibrary.com/r/blog%3Atrenchant-io-two-lines-of-jscript-for-20000-pwn2own-miami-2022.md)
- Config or template paths taken from user-writable locations or CWD

## How to review
Check the exact property: every executed or loaded path must be absolute and trusted, or the lookup must not be influenced by attacker-controlled state (PATH, CWD, config, sentinel values).
- Grep for bare command names in privileged code; confirm absolute paths or a sanitized environment.
- For duplication/clone APIs, verify unset fields stay unset, not replaced by placeholder strings that later resolve to files [E3](https://bugbountylibrary.com/r/h1%3A2215578.md).
- For file-format handlers, confirm the auth/trust check sits in the shared deserialization path, not per extension [E1](https://bugbountylibrary.com/r/blog%3Atrenchant-io-two-lines-of-jscript-for-20000-pwn2own-miami-2022.md).
- Confirm CWD-relative opens cannot be redirected by a local user.

## Variants seen
- PATH hijack of bare binary names in a root daemon [E2](https://bugbountylibrary.com/r/h1%3A784714.md)
- Sentinel string `none` stored as cookie filename, loaded from CWD on cloned handle [E3](https://bugbountylibrary.com/r/h1%3A2215578.md)
- Sibling file format (.tdfx) bypassing auth that gates the same parser (.gdfx) [E1](https://bugbountylibrary.com/r/blog%3Atrenchant-io-two-lines-of-jscript-for-20000-pwn2own-miami-2022.md)

## Impact and severity
Led to local privilege escalation to root [E2](https://bugbountylibrary.com/r/h1%3A784714.md), arbitrary code execution via crafted template file [E1](https://bugbountylibrary.com/r/blog%3Atrenchant-io-two-lines-of-jscript-for-20000-pwn2own-miami-2022.md), and cookie injection from an attacker-placed file [E3](https://bugbountylibrary.com/r/h1%3A2215578.md). Severity rises when the resolving process is privileged, when the path is attacker-writable, or when the check is applied inconsistently across formats sharing one parser [E1](https://bugbountylibrary.com/r/blog%3Atrenchant-io-two-lines-of-jscript-for-20000-pwn2own-miami-2022.md).

## Evidence
- E1: https://bugbountylibrary.com/r/blog%3Atrenchant-io-two-lines-of-jscript-for-20000-pwn2own-miami-2022.md
- E2: https://bugbountylibrary.com/r/h1%3A784714.md
- E3: https://bugbountylibrary.com/r/h1%3A2215578.md