CVE-2026-88922

תיאור (מקור, אנגלית)

The go-getter library up to versions 1.8.8 and 2.2.3 is vulnerable to a privilege escalation issue in its archive decompression handling that may allow a crafted archive to cause extracted files to be created with elevated permission bits. Where extraction is performed by a privileged user, this may allow a local actor to obtain the privileges of the extracting process. This vulnerability (CVE-2026-88922) is fixed in go-getter 1.8.9 and 2.2.4.

מדדים

CVSS 3.1

6.7 (MEDIUM) מקור הציון: CNA CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H

EPSS — סבירות ניצול

0% (אחוזון 000) נכון ל-19/9/2026

CWE

CWE-281

קישורים

• https://discuss.hashicorp.com/t/hcsec-2026-39-go-getter-vulnerable-to-a-privil‮…