CVE-2025-0377: HashiCorp go-slug Vulnerable to Zip Slip Attack
Summary
CVE-2025-0377: HashiCorp go-slug Vulnerable to Zip Slip Attack. Affects github.com/hashicorp/go-slug versions < 0.16.3. Fixed in 0.16.3. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
HashiCorp's go-slug library is a shared library designed for packing and unpacking Terraform Enterprise compatible slugs. These slugs are gzip compressed tar files that contain Terraform configuration files, facilitating the deployment and management of infrastructure as code. The library is widely used in environments that rely on Terraform for infrastructure automation, making its security critical.
Vulnerability Detail
The vulnerability identified as CVE-2025-0377 in the go-slug library allows for a zip-slip style attack due to improper validation of paths during the extraction process. When a tar entry is extracted, the filename is taken directly from the tar header without adequate checks. This oversight can lead to path traversal vulnerabilities, enabling an attacker to write arbitrary files to the filesystem during extraction. The potential ramifications include unauthorized file creation and manipulation, which could compromise system integrity and security.
How To Fix
Minimum fixed version
0.16.3
This is the first release that contains the fix.
go get github.com/hashicorp/go-slug@v0.16.3Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users should validate and sanitize any user-provided paths before passing them to the go-slug extraction functions. This can help mitigate the risk of path traversal attacks until the library is updated. For example, implement checks to ensure that the extracted paths do not contain any directory traversal sequences (e.g., '../').
Conclusion
The vulnerability in HashiCorp's go-slug library poses a significant risk due to improper path validation during file extraction. Users are strongly encouraged to upgrade to version 0.16.3 or later to mitigate this risk. Additionally, implementing input validation can provide an extra layer of security until the upgrade is completed.
See every vulnerability recorded for github.com/hashicorp/go-slug →
FAQ
A Zip Slip attack is a type of vulnerability that occurs when an application extracts files from a compressed archive without properly validating the file paths. This can allow attackers to write files outside of the intended directory.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up or install anything.
If exploited, this vulnerability can allow attackers to create or overwrite files on the server, potentially leading to data breaches, system compromise, or unauthorized access.
Yes, you can implement input validation and sanitization for any paths provided to the go-slug extraction functions to reduce the risk of exploitation.
The CVSS score for this vulnerability is 7.5, indicating a high severity level.
Related vulnerabilities
Recent vulnerabilities recorded for github.com/hashicorp/go-slug.
