CVE-2024-3817criticalCWE-88

CVE-2024-3817: fallo crítico en HashiCorp Shared library

HashiCorp go-getter Vulnerable to Argument Injection When Fetching Remote Default Git Branches

Publicada el · Actualizada el

Seguir esta CVE+ Monitorear Shared library+ Monitorear golang-github-hashicorp-go-getter

Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.

28Vexday Risk Score

Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.

ssvc Trackcvss 9.8epss 1.3%
HashiCorp’s go-getter library is vulnerable to argument injection when executing Git to discover remote branches. This vulnerability does not affect the go-getter/v2 branch and package.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Productos afectados
HashiCorp · Shared library
CVEs relacionadas — HashiCorp Shared library

En el mismo producto, de las más peligrosas a las menos.

CVE-2024-6257HIGHHashiCorp go-getter Vulnerable to Code Execution On Git Update Via Git Config ManipulationEPSS 1.0%CVE-2025-0377HIGHHashiCorp go-slug Vulnerable to Zip Slip AttackEPSS 0.7%CVE-2026-0969HIGHArbitrary code execution in React server-side rendering of untrusted MDX contentEPSS 0.6%CVE-2025-8959HIGHHashiCorp go-getter Vulnerable to Arbitrary Read through Symlink AttackEPSS 0.6%CVE-2024-6104MEDIUMgo-retryablehttp can leak basic auth credentials to log filesEPSS 0.4%CVE-2026-14362MEDIUMDenial of service via crafted push/pull gossip message in memberlistEPSS 0.3%