Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 3

Export CSV
CVE-2026-14978

Unicode normalization mismatch in go-slug ignore pattern matching may bypass intended file exclusions

HashiCorp go-slug 0.4.0 through 0.18.2 could allow a local attacker to bypass .terraformignore exclusions and cause sensitive files to be included in Terraform slug uploads due to improper handling of Unicode normalization during path matching.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed
Vendors
Hashicorp
Products
Go-slug Go Slug
CVE-2025-0377

HashiCorp go-slug Vulnerable to Zip Slip Attack

HashiCorp’s go-slug library is vulnerable to a zip-slip style attack when a non-existing user-provided path is extracted from the tar entry.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Hashicorp
Products
Go-slug
CVE-2020-29529

go-slug: partial protection against zip slip attacks

HashiCorp go-slug up to 0.4.3 did not fully protect against directory traversal while unpacking tar archives, and protections could be bypassed with specific constructions of multiple symlinks. Fixed in 0.5.0.

CVSS 3.1 · 7.5 High EPSS 2.8% KEV · Not listed
Vendors
Hashicorp Redhat
Products
Go-slug Acm