221 matches found
CVE-2026-4660
HashiCorp’s go-getter library up to v1.8.5 may allow arbitrary file reads on the file system during certain git operations through a maliciously crafted URL. This vulnerability, CVE-2026-4660, is fixed in go-getter v1.8.6. This vulnerability does not affect the go-getter/v2 branch and package...
CVE-2026-4660 Go-getter may allow to arbitrary filesystem reads through git operations
HashiCorp’s go-getter library up to v1.8.5 may allow arbitrary file reads on the file system during certain git operations through a maliciously crafted URL. This vulnerability, CVE-2026-4660, is fixed in go-getter v1.8.6. This vulnerability does not affect the go-getter/v2 branch and package...
CVE-2026-4660
CVE-2026-4660 affects HashiCorp go-getter up to v1.8.5, where a crafted URL during certain git operations can cause arbitrary filesystem reads. The issue is fixed in go-getter v1.8.6; the v2 branch/package is unaffected. If you use go-getter, upgrade to v1.8.6 or later. The provided sources do no...
CVE-2026-4660 Go-getter may allow to arbitrary filesystem reads through git operations
HashiCorp’s go-getter library up to v1.8.5 may allow arbitrary file reads on the file system during certain git operations through a maliciously crafted URL. This vulnerability, CVE-2026-4660, is fixed in go-getter v1.8.6. This vulnerability does not affect the go-getter/v2 branch and package...
Go-getter may allow to arbitrary filesystem reads through git operations
Summary HashiCorp’s go-getter library up to v1.8.5 may allow arbitrary file reads on the file system during certain git operations through a maliciously crafted URL. This vulnerability, CVE-2026-4660, is fixed in go-getter v1.8.6. This vulnerability does not affect the go-getter/v2 branch and...
HashiCorp go-getter 安全漏洞
HashiCorp go-getter is a Go golang library from the American company HashiCorp, used to download files or directories using URLs as the main input format from various sources. HashiCorp go-getter versions prior to v1.8.5 contained a security vulnerability that allowed arbitrary files to be read...
PT-2026-31612
Name of the Vulnerable Software and Affected Versions go-getter versions up to 1.8.5 Description The go-getter library may allow arbitrary file reads on the file system during certain git operations through a maliciously crafted URL. Recommendations Update to go-getter version 1.8.6 or later...
Linux Distros Unpatched Vulnerability : CVE-2026-4660
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - HashiCorp's go-getter library up to v1.8.5 may allow arbitrary file reads on the file system during certain git operations through a maliciously crafted URL. Th...
EUVD-2024-1274
Malicious code in bioql PyPI...
EUVD-2025-25049
Malicious code in bioql PyPI...
EUVD-2022-1942
Malicious code in bioql PyPI...
EUVD-2022-3749
Malicious code in bioql PyPI...
EUVD-2022-3588
Malicious code in bioql PyPI...
EUVD-2022-5681
Malicious code in bioql PyPI...
EUVD-2023-0733
Malicious code in bioql PyPI...
EUVD-2022-1591
Malicious code in bioql PyPI...
Symlink Attack
github.com/hashicorp/go-getter is vulnerable to Symlink Attack. The vulnerability is due to the subdirectory download feature allowing symbolic links to escape designated directory boundaries and access unauthorized files...
Linux Distros Unpatched Vulnerability : CVE-2025-8959
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - HashiCorp's go-getter library subdirectory download feature is vulnerable to symlink attacks leading to unauthorized read access beyond the designated directory...
Linux Distros Unpatched Vulnerability : CVE-2023-0475
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - HashiCorp go-getter up to 1.6.2 and 2.1.1 is vulnerable to decompression bombs. Fixed in 1.7.0 and 2.2.0. CVE-2023-0475 Note that Nessus relies on the presence ...
Linux Distros Unpatched Vulnerability : CVE-2024-6257
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - HashiCorp's go-getter library can be coerced into executing Git update on an existing maliciously modified Git Configuration, potentially leading to arbitrary...