{"action":"Upgrade github.com/opentofu/opentofu to 1.11.10 or later.","affected":[{"fixed":"1.11.10","introduced":"0"},{"fixed":"1.12.3","introduced":"1.12.0-beta1"}],"component":"github.com/opentofu/opentofu","cve_ids":[],"ecosystem":"Go","exploited":false,"fixed_versions":["1.11.10","1.12.3"],"ghsa_id":"GHSA-q7j3-v8qv-22vq","id":"tcs_01M5KFJJAXBN9577M2A250J20V","modified_at":"2026-06-25T23:11:47.943965215Z","published_at":"2026-06-19T16:35:09Z","references":["https://osv.dev/vulnerability/GHSA-q7j3-v8qv-22vq","https://github.com/opentofu/opentofu/security/advisories/GHSA-q7j3-v8qv-22vq","https://github.com/opentofu/opentofu/pull/4288","https://github.com/opentofu/opentofu/pull/4292","https://github.com/opentofu/opentofu/pull/4293","https://github.com/advisories/GHSA-92mm-2pjq-r785","https://github.com/hashicorp/go-getter/releases/tag/v1.8.6","https://github.com/opentofu/opentofu","https://github.com/opentofu/opentofu/releases/tag/v1.11.10","https://github.com/opentofu/opentofu/releases/tag/v1.12.3"],"severity":{"label":"high","score":7.5},"sources":[{"source":"osv","source_id":"GHSA-q7j3-v8qv-22vq","url":"https://osv.dev/vulnerability/GHSA-q7j3-v8qv-22vq"}],"summary":"OpenTofu: Possible arbitrary file read during certain git operations via a maliciously crafted URL"}