CVE-2026-4660

HighCVSS 7.5

Published: 09/04/2026(UTC)Updated: 26/10/2026(UTC)Translated: 16/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.58%

48th percentile - higher than 48% of all known CVEs

Summary

HashiCorp's go-getter library up to v1.8.5 allows arbitrary file reads on the file system during certain git operations through a maliciously crafted URL. This vulnerability is fixed in go-getter v1.8.6.

Risk Assessment

An attacker can exploit this vulnerability to read sensitive files on the system, potentially leading to data leakage or privilege escalation.

Recommendation

Immediately update the go-getter library to version 1.8.6 or later. The v2 branch is not affected.

Other vulnerabilities in go-getter

CVE-2026-88922Medium
The go-getter library up to versions 1.8.8 and 2.2.3 is vulnerable to a privilege escalation issue in its archive decompression handling that may allow a crafted archive to cause extracted files to be created with elevated permission bits. Where extraction is performed by a privileged user, this may allow a local actor to obtain the privileges of the extracting process.

Original NVD description (English source)

HashiCorp’s go-getter library up to v1.8.5 may allow arbitrary file reads on the file system during certain git operations through a maliciously crafted URL. This vulnerability, CVE-2026-4660, is fixed in go-getter v1.8.6. This vulnerability does not affect the go-getter/v2 branch and package.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS