VulertSecurity VulertSecurity

Vulnerability Database · Go · Package report

github.com/hashicorp/go-getter: vulnerability history, versions and safety

github.com/hashicorp/go-getter is a package in the Go ecosystem. Vulert records 18 vulnerabilities for it across 120 releases, from Apr 2022 to Jun 2026. Each vulnerability names the versions it affects, the fixed version to move to, and a workaround where no fix has been published.

i
18 vulnerabilities recorded C2 H6 M2 U8
i
0 with no fix published

Every vulnerability has a patched version to move to.

i
2 in the last 12 months

Most recent disclosure 22 Jun 2026.

See the disclosure history →
i
0 malicious-package vulnerabilities

No published version shipped hostile code.

See all github.com/hashicorp/go-getter vulnerabilities

Vulert verdict on github.com/hashicorp/go-getter v1.8.10 i

Updated on 23 Oct 2026

Action needed: v1.8.10 has 16 known vulnerabilities, but every one of them has a fix. Upgrade to the version listed below and you are clear.

Package health score 73/100
  • Security Some issues to review
  • Maintenance Sustainable
  • Popularity Widely used
  • Community Moderate

What to do: Upgrade to the version that resolves each vulnerability below. Fix it, then keep watch: this version is affected today, and the next one may be too — Vulert alerts you when a new vulnerability lands. Monitor it with Vulert →

  • Current release v1.8.10 — affected i
  • Vulnerabilities on record 18 over 4 years · 2 in the last year i
  • Latest disclosure 22 Jun 2026 i
  • Highest CVSS 9.8 i
  • With no published fix 0 i
  • Stars 1,826 i
  • OpenSSF scorecard 5/10 i
  • Last release this month i
  • Licence MPL-2.0 i

Version list, release dates, licence and dependants published by the Go module proxy, refreshed 23 Oct 2026. Licence information is not legal advice.

Concerned about your application's security?

Vulert continues monitoring your dependencies and alerts you when new vulnerabilities are disclosed. No installation and no source-code access required.

01 Versions

Which versions are affected

Every version Vulert tracks for github.com/hashicorp/go-getter, newest first, with the vulnerabilities recorded against each one. A version showing none has no vulnerability in the Vulert database — open it for the full picture on that release.

i
Version Released Vulert vulnerabilities Licence Fix published Details
v1.8.9-0.20261019073727-690b6555f2a8 19 Oct 2026 C1 H6 M2 U7 MPL-2.0 Yes Details →
v1.8.9-0.20261012063543-0e7439db00e7 12 Oct 2026 C1 H6 M2 U7 MPL-2.0 Yes Details →
v1.8.9-0.20261008125440-74c122051e57 08 Oct 2026 C1 H6 M2 U7 MPL-2.0 Yes Details →
v1.8.9-0.20261006140908-feb025dcac2d 06 Oct 2026 C1 H6 M2 U7 MPL-2.0 Yes Details →
v1.8.10 06 Oct 2026 C1 H6 M2 U7 MPL-2.0 Yes Details →
v1.8.9-0.20261005063825-f512b8205400 05 Oct 2026 C1 H6 M2 U7 MPL-2.0 Yes Details →
v1.8.9-0.20260928062928-fa06524bca43 28 Sep 2026 C1 H6 M2 U7 MPL-2.0 Yes Details →
v1.8.9-0.20260922062207-cb9c40a995f5 22 Sep 2026 C1 H6 M2 U7 MPL-2.0 Yes Details →
v1.8.9-0.20260907080000-2efe0e2a3bf7 07 Sep 2026 C1 H6 M2 U7 MPL-2.0 Yes Details →
v1.8.9-0.20260904164251-a64675c0ab70 04 Sep 2026 C1 H6 M2 U7 MPL-2.0 Yes Details →
v1.8.9-0.20260904135642-ab07dc6b051c 04 Sep 2026 C1 H6 M2 U7 MPL-2.0 Yes Details →
v1.8.9 03 Sep 2026 C1 H6 M2 U7 MPL-2.0 Yes Details →
v1.8.9-0.20260902125451-38aa4a65fd0d 02 Sep 2026 C1 H6 M2 U7 MPL-2.0 Yes Details →
v1.8.9-0.20260825150039-277f03531abe 25 Aug 2026 C1 H6 M2 U7 MPL-2.0 Yes Details →
v1.8.9-0.20260818124537-7de2140c6210 18 Aug 2026 C1 H6 M2 U7 MPL-2.0 Yes Details →
v1.8.9-0.20260817073453-be14b4c02f33 17 Aug 2026 C1 H6 M2 U7 MPL-2.0 Yes Details →
v1.8.8 12 Aug 2026 C1 H6 M2 U7 MPL-2.0 Yes Details →
v1.8.7 11 Aug 2026 C1 H6 M2 U7 MPL-2.0 Yes Details →
v1.8.7-0.20260727062553-4d09f7f40f25 27 Jul 2026 C1 H6 M2 U7 MPL-2.0 Yes Details →
v1.8.7-0.20260720063822-e5628776f248 20 Jul 2026 C1 H6 M2 U7 MPL-2.0 Yes Details →
v0.0.0-20260713125229-a8dd7f993aa9 13 Jul 2026 C1 H6 M2 U7 MPL-2.0 Yes Details →
v1.8.7-0.20260713125229-a8dd7f993aa9 13 Jul 2026 C1 H6 M2 U7 MPL-2.0 Yes Details →
v1.8.7-0.20260706061048-3e9de47d7401 06 Jul 2026 C1 H6 M2 U7 MPL-2.0 Yes Details →
v1.8.7-0.20260622071535-d7785c0bddbe 22 Jun 2026 C1 H6 M2 U7 MPL-2.0 Yes Details →
v1.8.7-0.20260602105315-6844d1e6916a 02 Jun 2026 C1 H6 M2 U7 MPL-2.0 Yes Details →
v1.8.7-0.20260522085435-c6cfb9236f4b 22 May 2026 C1 H6 M2 U7 MPL-2.0 Yes Details →
v1.8.7-0.20260413050133-2c30ec1f034c 13 Apr 2026 C1 H6 M2 U7 MPL-2.0 Yes Details →
v1.8.7-0.20260410130827-482569ad777d 10 Apr 2026 C1 H6 M2 U7 MPL-2.0 Yes Details →
v1.8.6 02 Apr 2026 C1 H6 M2 U7 MPL-2.0 Yes Details →
v1.8.6-0.20260330053207-388f23d7d40f 30 Mar 2026 C1 H6 M2 U7 MPL-2.0 Yes Details →
v1.8.6-0.20260326180230-965fd72af252 26 Mar 2026 C1 H6 M2 U7 MPL-2.0 Yes Details →
v1.8.6-0.20260326180015-42beaa9a7382 26 Mar 2026 C1 H6 M2 U7 MPL-2.0 Yes Details →
v1.8.6-0.20260325104424-ca510b29e432 25 Mar 2026 C1 H6 M2 U7 MPL-2.0 Yes Details →
v1.8.6-0.20260312033204-4a760255ed16 12 Mar 2026 C1 H6 M2 U7 MPL-2.0 Yes Details →
v1.8.5 10 Mar 2026 C1 H6 M2 U7 MPL-2.0 Yes Details →
v1.8.5-0.20260302092405-b83a3c7d84fe 02 Mar 2026 C1 H6 M2 U7 MPL-2.0 Yes Details →
v1.8.5-0.20260227081937-90c7d9c1e200 27 Feb 2026 C1 H6 M2 U7 MPL-2.0 Yes Details →
v1.8.5-0.20260219120140-8fa22a6c9880 19 Feb 2026 C1 H6 M2 U7 MPL-2.0 Yes Details →
v1.8.5-0.20260216010815-b7e10d785d8c 16 Feb 2026 C1 H6 M2 U7 MPL-2.0 Yes Details →
v1.8.4 29 Dec 2025 C1 H6 M2 U7 MPL-2.0 Yes Details →
v1.8.4-0.20251217093713-228ad65a8b51 17 Dec 2025 C1 H6 M2 U7 MPL-2.0 Yes Details →
v1.8.4-0.20251120055009-5cb8b18db2d1 20 Nov 2025 C1 H6 M2 U7 MPL-2.0 Yes Details →
v1.8.3 30 Oct 2025 C1 H6 M2 U7 MPL-2.0 Yes Details →
v1.8.3-0.20251030052800-13f1bb2b1a00 30 Oct 2025 C1 H6 M2 U7 MPL-2.0 Yes Details →
v1.8.3-0.20251013052534-cfc3a4f04b43 13 Oct 2025 C1 H6 M2 U7 MPL-2.0 Yes Details →
v1.8.2 03 Oct 2025 C1 H6 M2 U7 MPL-2.0 Yes Details →
v1.8.1 17 Sep 2025 C1 H6 M2 U7 MPL-2.0 Yes Details →
v1.8.1-0.20250908190449-4bddabbe782c 08 Sep 2025 C1 H6 M2 U7 MPL-2.0 Yes Details →
v1.8.1-0.20250907204202-aa02a21ae064 07 Sep 2025 C1 H6 M2 U7 MPL-2.0 Yes Details →
v1.8.0 05 Sep 2025 C1 H6 M2 U7 MPL-2.0 Yes Details →
v1.7.10 04 Sep 2025 C1 H6 M2 U7 MPL-2.0 Yes Details →
v1.7.10-0.20250902172143-bb1ddfbd8485 02 Sep 2025 C1 H6 M2 U7 MPL-2.0 Yes Details →
v1.7.10-0.20250831050358-1aa25c92d869 31 Aug 2025 C1 H6 M2 U7 MPL-2.0 Yes Details →
v1.7.10-0.20250826072604-0e25fa895850 26 Aug 2025 C1 H6 M2 U7 MPL-2.0 Yes Details →
v1.7.10-0.20250820183506-048ef734c463 20 Aug 2025 C1 H6 M2 U7 MPL-2.0 Yes Details →
v1.7.9 11 Aug 2025 C1 H6 M2 U7 MPL-2.0 Yes Details →
v1.7.9-0.20250810051108-df0a14fa67f2 10 Aug 2025 C1 H6 M2 U7 MPL-2.0 Yes Details →
v1.7.9-0.20250809003508-87541b2501c0 09 Aug 2025 C1 H6 M2 U7 MPL-2.0 Yes Details →
v1.7.9-0.20250625044933-37130302313c 25 Jun 2025 C1 H6 M2 U7 MPL-2.0 Yes Details →
v1.7.9-0.20250505220212-f6bd417710ec 05 May 2025 C1 H6 M2 U7 MPL-2.0 Yes Details →
v1.7.9-0.20250319175022-c831ccdce06c 19 Mar 2025 C1 H6 M2 U7 MPL-2.0 Yes Details →
v0.0.0-20250114055341-f7836fb97529 14 Jan 2025 C1 H6 M2 U7 MPL-2.0 Yes Details →
v1.7.8 14 Jan 2025 C1 H6 M2 U7 MPL-2.0 Yes Details →
v1.7.7-0.20250109100531-0f05341f2d7b 09 Jan 2025 C1 H6 M2 U7 MPL-2.0 Yes Details →
v1.7.7 09 Jan 2025 C1 H6 M2 U7 MPL-2.0 Yes Details →
v1.7.7-0.20241118155240-842d6c379e5e 18 Nov 2024 C1 H6 M2 U7 MPL-2.0 Yes Details →
v1.7.7-0.20241107184238-6077ad5a32c0 07 Nov 2024 C1 H6 M2 U7 MPL-2.0 Yes Details →
v1.7.7-0.20241106155932-b19f8af96cea 06 Nov 2024 C1 H6 M2 U7 MPL-2.0 Yes Details →
v1.7.7-0.20241009195306-768e85f2e16b 09 Oct 2024 C1 H6 M2 U7 MPL-2.0 Yes Details →
v1.7.6 14 Aug 2024 C1 H6 M2 U7 MPL-2.0 Yes Details →
v1.7.6-0.20240801191417-8339301726cc 01 Aug 2024 C1 H6 M2 U7 MPL-2.0 Yes Details →
v1.7.5 21 Jun 2024 C1 H6 M2 U7 MPL-2.0 Yes Details →
v0.0.0-20240620155032-5b7ec5f03919 20 Jun 2024 C1 H6 M2 U7 MPL-2.0 Yes Details →
v1.7.5-0.20240620140656-9906874a2391 20 Jun 2024 C1 H6 M2 U7 MPL-2.0 Yes Details →
v1.7.4 15 Apr 2024 C1 H6 M2 U7 MPL-2.0 Yes Details →
v1.7.4-0.20240412190623-aa98faf317f2 12 Apr 2024 C1 H6 M2 U7 MPL-2.0 Yes Details →
v0.0.0-20231204232417-975961f5f063 04 Dec 2023 C1 H6 M2 U7 MPL-2.0 Yes Details →
v1.7.4-0.20231204232417-975961f5f063 04 Dec 2023 C1 H6 M2 U7 MPL-2.0 Yes Details →
v0.0.0-20231010134938-0298a221674f 10 Oct 2023 C1 H6 M2 U7 MPL-2.0 Yes Details →
v1.7.3 10 Oct 2023 C1 H6 M2 U7 MPL-2.0 Yes Details →
v1.7.3-0.20230918141820-3d5770fe3ae1 18 Sep 2023 C1 H6 M2 U7 MPL-2.0 Yes Details →
v0.0.0-20230911085633-e66f244d9206 11 Sep 2023 C1 H6 M2 U7 MPL-2.0 Yes Details →
v1.7.3-0.20230911085633-e66f244d9206 11 Sep 2023 C1 H6 M2 U7 MPL-2.0 Yes Details →
v1.7.3-0.20230908131243-2d49e243e190 08 Sep 2023 C1 H6 M2 U7 MPL-2.0 Yes Details →
v0.0.0-20230411151822-c12e42f9c2a9 11 Apr 2023 C1 H6 M2 U7 MPL-2.0 Yes Details →
v1.7.2 11 Apr 2023 C1 H6 M2 U7 MPL-2.0 Yes Details →
v1.7.2-0.20230411151822-c12e42f9c2a9 11 Apr 2023 C1 H6 M2 U7 MPL-2.0 Yes Details →
v1.7.2-0.20230410154411-8480407c393d 10 Apr 2023 C1 H6 M2 U7 MPL-2.0 Yes Details →
v1.7.2-0.20230317172337-91e93376c7e9 17 Mar 2023 C1 H6 M2 U7 MPL-2.0 Yes Details →
v1.7.1 13 Mar 2023 C1 H6 M2 U7 MPL-2.0 Yes Details →
v1.7.1-0.20230310193140-32cd097ffa65 10 Mar 2023 C1 H6 M2 U7 MPL-2.0 Yes Details →
v1.6.3-0.20230210143508-0edab8534827 10 Feb 2023 C1 H6 M2 U7 MPL-2.0 Yes Details →
v1.7.0 10 Feb 2023 C1 H6 M2 U7 MPL-2.0 Yes Details →
v1.6.3-0.20230209152004-78e6721a2a76 09 Feb 2023 C1 H6 M2 U7 MPL-2.0 Yes Details →
v1.6.3-0.20230125192723-d229395f5a7d 25 Jan 2023 C1 H6 M2 U7 MPL-2.0 Yes Details →
v1.6.3-0.20221026204825-611343a8c115 26 Oct 2022 C1 H6 M2 U7 MPL-2.0 Yes Details →
v1.6.3-0.20221012060811-f7a8c48a1f86 12 Oct 2022 C1 H6 M2 U7 MPL-2.0 Yes Details →
v1.6.3-0.20221005160426-5ce69c3ebb08 05 Oct 2022 C1 H6 M2 U7 MPL-2.0 Yes Details →
v1.6.3-0.20220920215840-3079b2af4dbf 20 Sep 2022 C1 H6 M2 U7 MPL-2.0 Yes Details →
v1.6.3-0.20220830183002-89add64b855c 30 Aug 2022 C1 H6 M2 U7 MPL-2.0 Yes Details →
v1.6.3-0.20220629182559-293f9e2372e5 29 Jun 2022 C1 H6 M2 U7 — Yes Details →
v1.6.2 13 Jun 2022 C1 H6 M2 U7 — Yes Details →
v1.6.2-0.20220608175131-cd6aaf87dc01 08 Jun 2022 C1 H6 M2 U7 — Yes Details →
v1.6.2-0.20220607161122-28c40bea1eec 07 Jun 2022 C1 H6 M2 U7 — Yes Details →
v1.6.2-0.20220607160251-35a9e31fa22b 07 Jun 2022 C1 H6 M2 U7 — Yes Details →
v1.6.2-0.20220524194551-c5e9d081082f 24 May 2022 C1 H6 M2 U7 — Yes Details →
v1.6.2-0.20220524184621-d4c5010a78f6 24 May 2022 C1 H6 M2 U7 — Yes Details →
v1.6.1 19 May 2022 C1 H6 M2 U7 — Yes Details →
v1.6.1-0.20220519134500-226a8c5a5282 19 May 2022 C1 H6 M2 U7 — Yes Details →
v1.5.12-0.20220518220035-a2ebce998f8d 18 May 2022 C1 H6 M2 U7 — Yes Details →
v1.6.0 18 May 2022 C1 H6 M2 U7 — Yes Details →
v1.5.12-0.20220201100303-4553965d9c4a 01 Feb 2022 C1 H6 M2 U7 — Yes Details →
v1.5.11 03 Jan 2022 C1 H6 M2 U7 — Yes Details →
v1.5.11-0.20220103223158-ca3851549131 03 Jan 2022 C1 H6 M2 U7 — Yes Details →
v1.5.11-0.20220103220037-f5cbbb458c14 03 Jan 2022 C1 H6 M2 U7 — Yes Details →
v1.5.11-0.20220103103047-17af21e717d3 03 Jan 2022 C1 H6 M2 U7 — Yes Details →
v1.5.11-0.20220103102204-36b68b2f68a3 03 Jan 2022 C1 H6 M2 U7 — Yes Details →
v1.5.10 22 Dec 2021 C1 H6 M2 U7 — Yes Details →
v1.5.10-0.20211203154559-64f1c03f893e 03 Dec 2021 C1 H6 M2 U7 — Yes Details →
v1.5.10-0.20211026172652-817ea417e296 26 Oct 2021 C1 H6 M2 U7 — Yes Details →

The newest 120 of 616 versions Vulert tracks. Severity counts are the vulnerabilities recorded against that exact release.

02 Disclosure history

How often vulnerabilities are recorded

  • 2022 9
  • 2023 1
  • 2024 4
  • 2025 2
  • 2026 2

Counted by the year Vulert recorded each vulnerability — the same date the table below shows as disclosed. 2 of the 18 were recorded in the last 12 months.

03 Vulnerabilities

Recorded vulnerabilities for github.com/hashicorp/go-getter

The 5 most severe of 18 vulnerabilities recorded for this package

Search all 18 in the database →
Vulnerability Severity Fixed version ↓ Disclosed ↓
CVE-2024-3817: HashiCorp go-getter Vulnerable to Argument Injection When Fetching Remote Default Git Branches 9.8 critical 1.7.4 17 Apr 2024
CVE-2022-26945: HashiCorp go-getter command injection 9.8 critical 1.6.1 26 May 2022
CVE-2022-30323: HashiCorp go-getter Unsafe Downloads Could Lead to Asymmetric Resource Exhaustion 8.6 high 1.6.1 26 May 2022
CVE-2022-30322: HashiCorp go-getter Unsafe Downloads Could Lead to Arbitrary Host Access 8.6 high 1.6.1 26 May 2022
CVE-2022-30321: HashiCorp go-getter unsafe downloads 8.6 high 1.6.1 26 May 2022

Vulnerability wrong, a fix missing, or a package we should cover? Report it and we will fix the record. Report Vulnerability Provide Feedback

Updated: 23/Oct/2026 · Vulnerabilities in our DB: 524315

Subscribe to Vulert on Telegram
Daily digest of new CVEs, critical and high severity, affected packages and fixes — plus a weekly roundup.
Join the channel →

Questions

About github.com/hashicorp/go-getter

Is github.com/hashicorp/go-getter safe to use?

Vulert records 18 vulnerabilities for github.com/hashicorp/go-getter in Go: 2 critical, 6 high, 2 medium and 0 low, plus 8 not yet rated. Every one of them has a published fix, so the practical answer is to run a supported release and keep it patched.

What is github.com/hashicorp/go-getter's Vulert package health score?

Vulert scores github.com/hashicorp/go-getter 73/100, which reads as in good shape. The score weighs the vulnerability record (40), maintenance and release cadence (25), adoption from dependents and stars (20) and community signals such as the OpenSSF scorecard and forks (15).

Is the latest version of github.com/hashicorp/go-getter affected?

Yes. v1.8.10, the version you would install today, has 16 known vulnerabilities, and every one of them has a published fix. Upgrade to the version listed for each.

Which version of github.com/hashicorp/go-getter should I use?

v1.8.10 is the version Vulert recommends for the affected releases. The version table above lists every release with the vulnerabilities recorded against it, so you can confirm the range you actually run.

How many vulnerabilities does github.com/hashicorp/go-getter have?

18 vulnerabilities are recorded for github.com/hashicorp/go-getter in the Go ecosystem: 2 critical, 6 high, 2 medium and 0 low, plus 8 not yet rated. The ledger on this page lists the same counts next to the date of the most recent disclosure.

How often are new github.com/hashicorp/go-getter vulnerabilities disclosed?

2 vulnerabilities were recorded for github.com/hashicorp/go-getter in the last 12 months, and the oldest entry in this database dates to 28 Apr 2022. Recency matters more than a lifetime total: it shows how actively new issues are being disclosed for the package you are considering.

Which versions of github.com/hashicorp/go-getter are affected?

Each vulnerability on this page lists the affected version range and the fixed version to move to. Open the vulnerability for the version you actually run — fixes are specific to a release line, not to the package as a whole.

How do I monitor github.com/hashicorp/go-getter for upcoming vulnerabilities?

Upload the manifest or SBOM for your application at vulert.com/scanner and Vulert keeps checking the github.com/hashicorp/go-getter version you actually run against new disclosures, then alerts you when one affects it. There is no installation and no source-code access required.