Unverified50% confidenceFactExact time
When the operating system looks up an executable file, it searches one by one through the directories listed in PATH in order; putting . into PATH causes the system to preferentially look for a program with the same name in the current directory, and an attacker can place a malicious executable with the same name (such as ls, git, python) to execute malicious code; this type of attack was historically called "current directory hijacking".
1
Sources
50%
Confidence
Long-term
Relevance
10/12/2026
First Seen
Sources
Related Entities
Related Claims
UnverifiedPlacing relative paths (such as . or ./bin) in PATH brings security risks: when executing commands in an untrusted directory, a malicious program with the same name may be run unexpectedly.76% similarUnverified该漏洞的技术本质是PATH劫持攻击，Cursor执行Git操作时会从项目目录中查找并调用git可执行文件71% similarUnverifiedA Path Traversal attack is one in which an attacker constructs special file paths (such as using '../' to navigate to a parent directory) to access unauthorized files or directories on a server.69% similarUnverifiedThe chroot mechanism in Unix systems restricts the scope of file system access by changing a process's root directory, and is one of the earliest sandbox prototypes.63% similarUnverifiedDependency confusion attacks exploit the characteristic of package managers to check public sources first when resolving dependencies, allowing attackers to register package names used internally by enterprises in order to trick build systems into downloading malicious code.60% similar
Cite This Claim
Stable URI
https://kongchang.com/claim/1012618API
curl https://kongchang.com/api/v1/knowledge/claims/1012618MCP
get_claim(id=1012618)