Hashicorp Shared Library vulnerabilities

10 vulnerabilities

Known vulnerabilities in Hashicorp Shared Library, newest first, with CVSS severity, EPSS, KEV listings, ransomware use and the affected versions.

9.1CVE-2025-0377chainguardopentofu-1.8+26
EPSS score
0.69%
HashiCorp’s go-slug library is vulnerable to a zip-slip style attack when a non-existing user-provided path is extracted from the tar entry.7.5CVE-2025-8959chainguardchainctl+110
EPSS score
0.57%
HashiCorp's go-getter library subdirectory download feature is vulnerable to symlink attacks leading to unauthorized read access beyond the designated directory boundaries. This vulnerability, identified as CVE-2025-8959, is fixed in go-getter 1.7.9.8.8CVE-2024-6257chainguardconftest+47
EPSS score
0.98%
HashiCorp’s go-getter library can be coerced into executing Git update on an existing maliciously modified Git Configuration, potentially leading to arbitrary code execution.6CVE-2024-6104chainguardaactl+296
EPSS score
0.36%
go-retryablehttp prior to 0.7.7 did not sanitize urls when writing them to its log file. This could lead to go-retryablehttp writing sensitive HTTP basic auth credentials to its log file. This vulnerability, CVE-2024-6104, was fixed in go-retryablehttp 0.7.7.9.8CVE-2024-3817chainguardconftest+26
EPSS score
1.33%
HashiCorp’s go-getter library is vulnerable to argument injection when executing Git to discover remote branches. This vulnerability does not affect the go-getter/v2 branch and package.5.3CVE-2026-19585debiangolang-github-hashicorp-go-getter+2
EPSS score
0.21%
HashiCorp go-getter versions before 1.8.10 and go-getter/v2 versions before 2.2.5 are vulnerable to path traversal during S3 and GCS directory downloads, which may allow files to be written outside the requested destination. This vulnerability (CVE-2026-19585) is fixed in go-getter 1.8.10 and go-getter/v2 2.2.5.8.8CVE-2026-0969hashicorpshared library+1
EPSS score
0.65%
The serialize function used to compile MDX in next-mdx-remote is vulnerable to arbitrary code execution due to insufficient sanitization of MDX content. This vulnerability, CVE-2026-0969, is fixed in next-mdx-remote 6.0.0.4.9CVE-2026-14362hashicorpshared library
EPSS score
0.44%
HashiCorp memberlist before version 0.6.0 is vulnerable to a denial-of-service issue in its push/pull state handling that may allow an attacker with network access to the gossip port to exhaust memory on a receiving node and cause the process to terminate. This vulnerability (CVE-2026-14362) is fixed in memberlist 0.6.0.6CVE-2026-8052ubuntunomad+2
EPSS score
0.17%
HashiCorp Nomad’s exec2 task driver prior to 0.1.2 is vulnerable to arbitrary file read and write on the client host as the Nomad process user through a symlink attack. This vulnerability (CVE-2026-8052) is fixed in version 0.1.2 of the exec2 task driver.6.7CVE-2026-88922debiangolang-github-hashicorp-go-getter+5
EPSS score
0.11%
The go-getter library up to versions 1.8.8 and 2.2.3 is vulnerable to a privilege escalation issue in its archive decompression handling that may allow a crafted archive to cause extracted files to be created with elevated permission bits. Where extraction is performed by a privileged user, this may allow a local actor to obtain the privileges of the extracting process. This vulnerability (CVE-2026-88922) is fixed in go-getter 1.8.9 and 2.2.4.