CVE-2024-3817

CRITICAL

HashiCorp's go-getter - Code Injection

Title source: llm

Description

HashiCorp’s go-getter library is vulnerable to argument injection when executing Git to discover remote branches. This vulnerability does not affect the go-getter/v2 branch and package.

References (1)

[Vendor Advisory] https://discuss.hashicorp.com/t/hcsec-2024-09-hashicorp-go-getter-vulnerable-to-argument-injection-when-fetching-remote-default-git-branches/66040

Scores

CVSS v3 9.8

EPSS 0.0213

EPSS Percentile 84.3%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CISA SSVC

Vulnrichment

Exploitation none

Automatable no

Technical Impact partial

Details

CWE

CWE-88

Status published

Products (2)

hashicorp/go-getter 1.5.9 - 1.7.4

hashicorp/go-getter 1.5.9 - 1.7.4Go

Published Apr 17, 2024

Tracked Since Feb 18, 2026