CVE-2026-88922: medium-severity vulnerability in HashiCorp Shared library
Go-getter vulnerable to a privilege escalation issue in its archive decompression handling
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
13Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 6.7epss 0.1%
The go-getter library up to versions 1.8.8 and 2.2.3 is vulnerable to a privilege escalation issue in its archive decompression handling that may allow a crafted archive to cause extracted files to be created with elevated permission bits. Where extraction is performed by a privileged user, this may allow a local actor to obtain the privileges of the extracting process. This vulnerability (CVE-2026-88922) is fixed in go-getter 1.8.9 and 2.2.4.
CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H
Affected products
HashiCorp · Shared libraryRelated CVEs — HashiCorp Shared library
In the same product, most dangerous first.
CVE-2024-3817CRITICALHashiCorp go-getter Vulnerable to Argument Injection When Fetching Remote Default Git BranchesEPSS 1.3%CVE-2024-6257HIGHHashiCorp go-getter Vulnerable to Code Execution On Git Update Via Git Config ManipulationEPSS 1.0%CVE-2025-0377HIGHHashiCorp go-slug Vulnerable to Zip Slip AttackEPSS 0.7%CVE-2026-0969HIGHArbitrary code execution in React server-side rendering of untrusted MDX contentEPSS 0.6%CVE-2025-8959HIGHHashiCorp go-getter Vulnerable to Arbitrary Read through Symlink AttackEPSS 0.6%CVE-2024-6104MEDIUMgo-retryablehttp can leak basic auth credentials to log filesEPSS 0.4%