Go-getter vulnerabilities
4 known vulnerabilities in Go-getter from HashiCorp. 4 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.
Latest first
- 7.5 High severity
Shared library: Improper Link Resolution Before File Access
HashiCorp's go-getter library subdirectory download feature is vulnerable to symlink attacks leading to unauthorized read access beyond the designated directory boundaries. This vulnerability, identified as CVE-2025-8959, is fixed in go-getter 1.7.9.
- 8.8 High severity
Shared library: Improper Neutralization of Special Elements used in a Command
HashiCorp’s go-getter library can be coerced into executing Git update on an existing maliciously modified Git Configuration, potentially leading to arbitrary code execution.
- 9.8 Critical severity
Shared library: Improper Neutralization of Argument Delimiters in a Command
HashiCorp’s go-getter library is vulnerable to argument injection when executing Git to discover remote branches. This vulnerability does not affect the go-getter/v2 branch and package.
- 8.6 High severity
Go-getter: Improper Limitation of a Pathname to a Restricted Directory
go-getter up to 1.5.11 and 2.0.2 allowed arbitrary host access via go-getter path traversal, symlink processing, and command injection flaws. Fixed in 1.6.1 and 2.1.0.