Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 9

Export CSV
CVE-2024-3817

HashiCorp go-getter Vulnerable to Argument Injection When Fetching Remote Default Git Branches

HashiCorp’s go-getter library is vulnerable to argument injection when executing Git to discover remote branches. This vulnerability does not affect the go-getter/v2 branch and package.

CVSS 3.1 · 9.8 Critical EPSS 1.3% KEV · Not listed
Vendors
Hashicorp
Products
Go-getter
CVE-2024-6257

HashiCorp go-getter Vulnerable to Code Execution On Git Update Via Git Config Manipulation

HashiCorp’s go-getter library can be coerced into executing Git update on an existing maliciously modified Git Configuration, potentially leading to arbitrary code execution.

CVSS 3.1 · 8.4 High EPSS < 1% KEV · Not listed
Vendors
Hashicorp
Products
Go-getter
CVE-2025-8959

HashiCorp go-getter Vulnerable to Arbitrary Read through Symlink Attack

HashiCorp's go-getter library subdirectory download feature is vulnerable to symlink attacks leading to unauthorized read access beyond the designated directory boundaries. This vulnerability, identified as CVE-2025-8959, is fixed in go-getter 1.7.9.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Hashicorp
Products
Go-getter
CVE-2023-0475

Go-Getter Vulnerable to Decompression Bombs

HashiCorp go-getter up to 1.6.2 and 2.1.1 is vulnerable to decompression bombs. Fixed in 1.7.0 and 2.2.0.

CVSS 3.1 · 4.2 Medium EPSS < 1% KEV · Not listed
Vendors
Hashicorp Redhat
Products
Go-getter Openshift
CVE-2022-30322

go-getter: unsafe download (issue 2 of 3)

go-getter up to 1.5.11 and 2.0.2 allowed asymmetric resource exhaustion when go-getter processed malicious HTTP responses. Fixed in 1.6.1 and 2.1.0.

CVSS 3.1 · 8.6 High EPSS 1.5% KEV · Not listed
Vendors
Hashicorp Redhat
Products
Go-getter Openshift Openstack
CVE-2022-30321

go-getter: unsafe download (issue 1 of 3)

go-getter up to 1.5.11 and 2.0.2 allowed arbitrary host access via go-getter path traversal, symlink processing, and command injection flaws. Fixed in 1.6.1 and 2.1.0.

CVSS 3.1 · 8.6 High EPSS 3.1% KEV · Not listed
Vendors
Hashicorp Redhat
Products
Go-getter Openshift Openstack
CVE-2022-29810

go-getter: writes SSH credentials into logfile, exposing sensitive credentials to local uses

The Hashicorp go-getter library before 1.5.11 does not redact an SSH key from a URL query parameter.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed
Vendors
Hashicorp Redhat
Products
Go-getter Acm Openshift and 1 more
CVE-2022-26945

go-getter: command injection vulnerability

go-getter up to 1.5.11 and 2.0.2 allowed protocol switching, endless redirect, and configuration bypass via abuse of custom HTTP response header processing. Fixed in 1.6.1 and 2.1.0.

CVSS 3.1 · 9.8 Critical EPSS 1.7% KEV · Not listed
Vendors
Hashicorp Redhat
Products
Go-getter Openshift Openstack