HashiCorp’s go-slug library is vulnerable to a zip-slip style attack when a non-existing user-provided path is extracted from the tar entry.
CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:NHashicorp Go Slug
APPHashicorp< 0.16.3
🔵
CHECK WITH VENDOR
No clear patch data available. Check vendor references.
CWE
Related vulnerabilities
CVE-2020-29529HIGH7.5same product
HashiCorp go-slug up to 0.4.3 did not fully protect against directory traversal while unpacking tar archives, ...
CVE-2026-14978MEDIUM5.5same product
HashiCorp go-slug 0.4.0 through 0.18.2 could allow a local attacker to bypass .terraformignore exclusions and ...
CVE-2025-6000CRITICAL9.1PL ✓same vendor
HashiCorp Vault: RCE przez uprzywilejowanego operatora via sys/audit
CVE-2024-3817CRITICAL9.8PL ✓same vendor
HashiCorp go-getter: argument injection przy odkrywaniu zdalnych gałęzi Git
CVE-2023-1782CRITICAL9.9PL ✓same vendor
HashiCorp Nomad: obejście ACL przez nieuwierzytelnionych użytkowników