Hashicorp
Hashicorp Go-getter: vulnerabilidades y CVE
Hashicorp Go-getter tiene 12 vulnerabilidades publicadas, 3 de ellas en los últimos 12 meses. 2 son críticas y 0 figuran en el catálogo de explotación activa de CISA.
CVE12
Últimos 12 meses3
Críticas2
Explotadas activamente0
Todas las vulnerabilidades en el catálogo →⭐ Seguir esta tecnología
Últimas vulnerabilidades
| CVE | Severidad | EPSS | Explotación activa | Publicada | Descripción |
|---|---|---|---|---|---|
| CVE-2026-88922 | Media (6.7) | 0.11% | — | 15 sept 2026 | The go-getter library up to versions 1.8.8 and 2.2.3 is vulnerable to a privilege escalation issue in its archive decompression handling that may allow a crafted archive to cause extracted files to be created with… |
| CVE-2026-54629 | Alta (7.5) | 0.97% | — | 14 sept 2026 | Anyquery is an SQL query engine built on top of SQLite. Prior to 0.4.5, anyquery server exposes file-backed SQLite virtual table modules such as csv_reader and log_reader through its MySQL-compatible server port without… |
| CVE-2026-4660 | Alta (7.5) | 0.55% | — | 9 abr 2026 | HashiCorp’s go-getter library up to v1.8.5 may allow arbitrary file reads on the file system during certain git operations through a maliciously crafted URL. This vulnerability, CVE-2026-4660, is fixed in go-getter… |
| CVE-2025-8959 | Alta (7.5) | 0.57% | — | 15 ago 2025 | HashiCorp's go-getter library subdirectory download feature is vulnerable to symlink attacks leading to unauthorized read access beyond the designated directory boundaries. This vulnerability, identified as… |
| CVE-2024-6257 | Alta (8.8) | 0.98% | — | 25 jun 2024 | HashiCorp’s go-getter library can be coerced into executing Git update on an existing maliciously modified Git Configuration, potentially leading to arbitrary code execution. |
| CVE-2024-3817 | Crítica (9.8) | 1.3% | — | 17 abr 2024 | HashiCorp’s go-getter library is vulnerable to argument injection when executing Git to discover remote branches. This vulnerability does not affect the go-getter/v2 branch and package. |
| CVE-2023-0475 | Media (6.5) | 0.45% | — | 16 feb 2023 | HashiCorp go-getter up to 1.6.2 and 2.1.1 is vulnerable to decompression bombs. Fixed in 1.7.0 and 2.2.0. |
| CVE-2022-30323 | Alta (8.6) | 1.4% | — | 25 may 2022 | go-getter up to 1.5.11 and 2.0.2 panicked when processing password-protected ZIP files. Fixed in 1.6.1 and 2.1.0. |
| CVE-2022-30322 | Alta (8.6) | 1.4% | — | 25 may 2022 | go-getter up to 1.5.11 and 2.0.2 allowed asymmetric resource exhaustion when go-getter processed malicious HTTP responses. Fixed in 1.6.1 and 2.1.0. |
| CVE-2022-30321 | Alta (8.6) | 3.3% | — | 25 may 2022 | go-getter up to 1.5.11 and 2.0.2 allowed arbitrary host access via go-getter path traversal, symlink processing, and command injection flaws. Fixed in 1.6.1 and 2.1.0. |
| CVE-2022-26945 | Crítica (9.8) | 1.7% | — | 25 may 2022 | go-getter up to 1.5.11 and 2.0.2 allowed protocol switching, endless redirect, and configuration bypass via abuse of custom HTTP response header processing. Fixed in 1.6.1 and 2.1.0. |
| CVE-2022-29810 | Media (5.5) | 0.41% | — | 27 abr 2022 | The Hashicorp go-getter library before 1.5.11 does not redact an SSH key from a URL query parameter. |
🎯 Cómo se explota (técnicas ATT&CK)
Número de CVE de esta tecnología asignadas a cada técnica de explotación o de impacto principal.