Skip to content
CVE PROGRAM SOURCE RECORD9.8 Critical

CVE-2024-3817

HashiCorp go-getter Vulnerable to Argument Injection When Fetching Remote Default Git Branches

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
HashiCorp

Description

HashiCorp’s go-getter library is vulnerable to argument injection when executing Git to discover remote branches. This vulnerability does not affect the go-getter/v2 branch and package.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

HashiCorp Shared library

Default version status: unaffected

  • 1.5.9 to < 1.7.3affected

References