CVE-2026-63644— bird-lg-go: Improper Neutralization of Argument Delimiters in a Command ('Argument Injection') and Exposure of Sensitive Information to an Unauthorized Actor in github.com/xddxdd/bird-lg-go

Quick assessment

Affected

xddxdd bird-lg-go

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

bird-lg-go 是一个用 Go 语言编写的 BIRD 望远镜（Looking Glass）工具。在 1.4.7 版本之前，未经验证的路径输入会导致任意本地文件读取漏洞，使得未经身份验证的远程攻击者能够读取敏感文件（例如 /etc/shadow 和 /root/.bash_history）。该问题已在 1.4.7 版本中修复。

CVSS 7.5 · High Updated Nov 10, 2026

Possible ATT&CK Techniques 1 AI

T1190 · Exploit Public-Facing Application

Get alerts for future matching vulnerabilities Log in to subscribe

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

bird-lg-go: Improper Neutralization of Argument Delimiters in a Command ('Argument Injection') and Exposure of Sensitive Information to an Unauthorized Actor in github.com/xddxdd/bird-lg-go

Source: CVE Program / CVE List V5

Vulnerability Description

bird-lg-go is a BIRD looking glass in Go. Prior to version 1.4.7, unsanitized input path enables arbitrary local file read, allowing an unauthenticated remote attacker to read sensitive files such as /etc/shadow and /root/.bash_history. This issue has been patched in version 1.4.7.

Source: CVE Program / CVE List V5