Hashicorp Go Slug vulnerabilities

3 vulnerabilities

Known vulnerabilities in Hashicorp Go Slug, newest first, with CVSS severity, EPSS, KEV listings, ransomware use and the affected versions.

9.1CVE-2025-0377chainguardopentofu-1.8+26
EPSS score
0.69%
HashiCorp’s go-slug library is vulnerable to a zip-slip style attack when a non-existing user-provided path is extracted from the tar entry.7.5CVE-2020-29529debiangolang-github-hashicorp-go-slug+3
EPSS score
2.82%
HashiCorp go-slug up to 0.4.3 did not fully protect against directory traversal while unpacking tar archives, and protections could be bypassed with specific constructions of multiple symlinks. Fixed in 0.5.0.5.5CVE-2026-14978chainguardhelmfile+34
EPSS score
0.14%
HashiCorp go-slug 0.4.0 through 0.18.2 could allow a local attacker to bypass .terraformignore exclusions and cause sensitive files to be included in Terraform slug uploads due to improper handling of Unicode normalization during path matching.