CVE-2024-3817: HashiCorp go-getter Vulnerable to Argument Injection When Fetching Remote Default Git Branches
Summary
CVE-2024-3817: HashiCorp go-getter Vulnerable to Argument Injection When Fetching Remote Default Git Branches. Affects github.com/hashicorp/go-getter versions >= 1.5.9, < 1.7.4. Fixed in 1.7.4. How to fix ↓
Also tracked for
- golang-github-hashicorp-go-getter · Debian:11
The same CVE-2024-3817 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
HashiCorp go-getter is a Go package that provides a simple and efficient way to fetch or clone repositories from various sources, including Git. It is commonly used in Go projects to retrieve dependencies or resources from remote repositories. However, versions prior to 1.7.4 are vulnerable to argument injection when fetching remote default Git branches.
Vulnerability Detail
The vulnerability in go-getter arises when it attempts to clone a Git repository without a specified reference. In such cases, go-getter will try to determine the remote repository's HEAD reference of its default branch by passing arguments to the Git binary on the host system. An attacker can exploit this behavior by crafting a malicious Git URL that includes additional Git arguments, leading to arbitrary command execution on the host system. This could result in unauthorized access, data manipulation, or even complete compromise of the system.
How To Fix
Latest published version: v1.8.10 as of 23 Oct 2026
go get github.com/hashicorp/go-getter@v1.8.10Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
1.7.4
This is the first release that contains the fix.
go get github.com/hashicorp/go-getter@v1.7.4Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to update to the patched version of go-getter to address the issue effectively.
Conclusion
The vulnerability in HashiCorp go-getter allows for argument injection when fetching remote default Git branches. This can lead to arbitrary command execution and potential compromise of the host system. To address this issue, it is recommended to upgrade go-getter to version 1.7.4 or later. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for github.com/hashicorp/go-getter →
FAQ
go-getter is a Go package used for fetching or cloning repositories from various sources, including Git. It simplifies the process of retrieving dependencies or resources in Go projects.
The vulnerability occurs when go-getter attempts to clone a Git repository without a specified reference. It then tries to determine the remote repository's default branch by passing arguments to the Git binary, which can be exploited for arbitrary command execution.
Exploiting this vulnerability can lead to unauthorized access, data manipulation, or complete compromise of the host system. Attackers can execute arbitrary commands on the system by injecting malicious arguments through a crafted Git URL.
To fix this vulnerability, upgrade go-getter to version 1.7.4 or later. This version includes a patch that prevents argument injection when fetching remote default Git branches.
No, there is no known workaround for this vulnerability. It is crucial to update to the patched version of go-getter to mitigate the issue.
Related vulnerabilities
Recent vulnerabilities recorded for github.com/hashicorp/go-getter.
