HashiCorp Shared library
10 published vulnerabilities name this product.
As the CNAs write it in their CVE records (vendor and product); the versions are theirs.
| CVE | Vulnerable versions | Title | Severity | Published | EPSS | Exploitation |
|---|---|---|---|---|---|---|
| CVE-2026-19585 | 1.0.1 – < 2.2.5 | Go-getter vulnerable to a path traversal in S3/GCS directory download handling | MEDIUM 5.3 | 0.2 % | ||
| CVE-2026-88922 | 1.0.1 – < 2.2.4 | Go-getter vulnerable to a privilege escalation issue in its archive decompression handling | MEDIUM 6.7 | 0.1 % | ||
| CVE-2026-14362 | 0.1.5 – < 0.6.0 | Denial of service via crafted push/pull gossip message in memberlist | MEDIUM 4.9 | 0.3 % | ||
| CVE-2026-8052 | 0.1.0 – < 0.1.2 | Nomad's exec2 task driver vulnerable to arbitrary file read/write on client host through symlink attack | MEDIUM 6.0 | 0.1 % | ||
| CVE-2026-0969 | 4.3.0 – < 6.0.0 | Arbitrary code execution in React server-side rendering of untrusted MDX content | HIGH 8.8 | 0.6 % | ||
| CVE-2025-8959 | < 1.7.8 | HashiCorp go-getter Vulnerable to Arbitrary Read through Symlink Attack | HIGH 7.5 | 0.6 % | ||
| CVE-2025-0377 | < 0.16.2 | HashiCorp go-slug Vulnerable to Zip Slip Attack | CRITICAL 9.1 | 0.7 % | ||
| CVE-2024-6257 | < 1.7.4 | HashiCorp go-getter Vulnerable to Code Execution On Git Update Via Git Config Manipulation | HIGH 8.8 | 1.0 % | ||
| CVE-2024-6104 | < 0.7.7 | go-retryablehttp can leak basic auth credentials to log files | MEDIUM 6.0 | 0.4 % | ||
| CVE-2024-3817 | 1.5.9 – < 1.7.3 | HashiCorp go-getter Vulnerable to Argument Injection When Fetching Remote Default Git Branches | CRITICAL 9.8 | 1.3 % |