github.com/hashicorp/go-getter vulnerabilities — 18 matching vulnerabilities

Concerned about your application's security?

Vulert continues monitoring your dependencies and alerts you when new vulnerabilities are disclosed — no installation and no source-code access required.

Scan your app free →
Severity Vulnerability Package Ecosystem Disclosed Fixed version
Unrated CVE-2026-4660: Arbitrary File Read Vulnerability in HashiCorp's go-getter Library github.com/hashicorp/go-getter Go 22 Jun 2026 1.8.6
7.5 high CVE-2026-4660: HashiCorp's go-getter Library Arbitrary File Read Vulnerability github.com/hashicorp/go-getter Go 09 Apr 2026 1.8.6
Unrated CVE-2025-8959: HashiCorp go-getter Symlink Attack Vulnerability github.com/hashicorp/go-getter Go 29 Aug 2025 1.7.9
7.5 high CVE-2025-8959: HashiCorp go-getter Vulnerable to Symlink Attacks github.com/hashicorp/go-getter Go 15 Aug 2025 1.7.9
Unrated CVE-2024-6257: Code Execution on Git update in github.com/hashicorp/go-getter github.com/hashicorp/go-getter Go 28 Jun 2024 1.7.5
8.4 high CVE-2024-6257: HashiCorp go-getter Vulnerable to Code Execution On Git Update Via Git Config Manipulation github.com/hashicorp/go-getter Go 25 Jun 2024 1.7.5
Unrated CVE-2024-3817: Argument injection when fetching remote default Git branches in github.com/hashicorp/go-getter github.com/hashicorp/go-getter Go 10 May 2024 1.7.4
9.8 critical CVE-2024-3817: HashiCorp go-getter Vulnerable to Argument Injection When Fetching Remote Default Git Branches github.com/hashicorp/go-getter Go 17 Apr 2024 1.7.4
4.2 medium CVE-2023-0475: Data Amplification in HashiCorp go-getter github.com/hashicorp/go-getter Go 16 Feb 2023 1.7.0
Unrated CVE-2022-29810: Sensitive Information Exposure in github.com/hashicorp/go-getter github.com/hashicorp/go-getter Go 01 Jul 2022 1.5.11
Unrated CVE-2022-29810: Sensitive Information Insertion into Log File in Hashicorp go-getter github.com/hashicorp/go-getter Go 01 Jul 2022 1.5.11
9.8 critical CVE-2022-26945: HashiCorp go-getter command injection github.com/hashicorp/go-getter Go 26 May 2022 1.6.1
Unrated CVE-2022-26945: Resource exhaustion in github.com/hashicorp/go-getter and related modules github.com/hashicorp/go-getter Go 26 May 2022 1.6.1
Unrated CVE-2022-26945: HashiCorp go-getter command injection github.com/hashicorp/go-getter Go 26 May 2022 1.6.1
8.6 high CVE-2022-30321: HashiCorp go-getter unsafe downloads github.com/hashicorp/go-getter Go 26 May 2022 1.6.1
8.6 high CVE-2022-30322: HashiCorp go-getter Unsafe Downloads Could Lead to Arbitrary Host Access github.com/hashicorp/go-getter Go 26 May 2022 1.6.1
8.6 high CVE-2022-30323: HashiCorp go-getter Unsafe Downloads Could Lead to Asymmetric Resource Exhaustion github.com/hashicorp/go-getter Go 26 May 2022 1.6.1
5.5 medium CVE-2022-29810: Sensitive Information Insertion in Hashicorp go-getter github.com/hashicorp/go-getter Go 28 Apr 2022 1.5.11
Subscribe to Vulert on Telegram
Daily digest of new CVEs, critical and high severity, affected packages and fixes — plus a weekly roundup.
Join the channel →

Questions

Searching the database

How do I search for a CVE or a package?

Type a CVE id, package name, ecosystem or keyword into the search field. Results include the severity, the affected package, the ecosystem, the disclosure date and the fixed version.

Can I filter by severity or by whether a fix exists?

Yes. The filters on the left narrow the list to critical, high, medium or low vulnerabilities, to a single ecosystem, and to vulnerabilities that have a fix available or none yet.

What does "No fix published" mean?

No patched version has been released for that vulnerability yet. The vulnerability page still shows the affected range and any workaround that can reduce exposure in the meantime.