CVE-2026-4660
2 advisories.
Go/github.com/hashicorp/go-getter CVE-2026-4660: high 7.5, EPSS 0.55%
HashiCorp's go-getter library may allow arbitrary file reads
Action: Upgrade github.com/hashicorp/go-getter to 1.8.6 or later.
go get github.com/hashicorp/go-getter@v1.8.6Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 1.8.6 | - |
Fixed versions
| 1.8.6 |
Sources
- osv: GHSA-92mm-2pjq-r785
- https://nvd.nist.gov/vuln/detail/CVE-2026-4660
- https://discuss.hashicorp.com/t/hcsec-2026-04-go-getter-may-allow-to-arbitrary-filesystem-reads-through-git-operations/77311
- https://github.com/hashicorp/go-getter
CVE-2026-4660 · published · modified · JSON
Go/github.com/hashicorp/go-getter CVE-2026-4660: unknown, EPSS 0.55%
HashiCorp's go-getter library may allow arbitrary file reads in github.com/hashicorp/go-getter
Action: Upgrade github.com/hashicorp/go-getter to 1.8.6 or later.
go get github.com/hashicorp/go-getter@v1.8.6Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 1.8.6 | - |
Fixed versions
| 1.8.6 |
Sources
- osv: GO-2026-5058
- https://github.com/advisories/GHSA-92mm-2pjq-r785
- https://discuss.hashicorp.com/t/hcsec-2026-04-go-getter-may-allow-to-arbitrary-filesystem-reads-through-git-operations/77311
CVE-2026-4660 · published · modified · JSON