CVE-2026-88922: hashicorp shared library Improper Preservation of Permissions
Vulnerability summary
CVE-2026-88922 is a medium (CVSS 6.7) Improper Preservation of Permissions vulnerability in hashicorp shared library. EPSS estimates a 0.11% chance of exploitation in the next 30 days, higher than 1.3% of scored vulnerabilities.
Advisory lineage
Upstream 0 · Downstream 2 · Related 1Timeline
- 15-09-2026PublishedVulnerability first disclosed.
- 20-09-2026Last modifiedVulnerability information updated.
Description
The go-getter library up to versions 1.8.8 and 2.2.3 is vulnerable to a privilege escalation issue in its archive decompression handling that may allow a crafted archive to cause extracted files to be created with elevated permission bits. Where extraction is performed by a privileged user, this may allow a local actor to obtain the privileges of the extracting process. This vulnerability (CVE-2026-88922) is fixed in go-getter 1.8.9 and 2.2.4.
CVSS metrics
4 scores · 4 sources · 1 version- OSV · Red hatEcosystem advisory · calculated6.7MediumCVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H
- OSV · DebianEcosystem advisory · calculated6.7MediumCVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H
- NVDNIST6.7MediumCVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H
EPSS trend
Probability
0.11%
Chance of exploitation in the next 30 days
Percentile
1%
Versus all other CVEs
30-day change
+0.03 pp
From 0.09% on 20-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Redhat4 products
- grype< 0:0.118.0-0.2.hum1
- opentofu1.10< 0:1.10.10-0.4.hum1
- opentofu1.12< 0:1.12.6-0.2.hum1
- syft< 0:1.51.1-0.2.hum1
Debian1 product
- golang-github-hashicorp-go-getterAll versions (No fix recorded)
Hashicorp1 product
- shared library≥ 1.0.1, < 2.2.4
3 vendors · 6 products
References
16 links- discuss.hashicorp.com/t/…ARTICLE
- images.redhat.comARTICLE
