go-getter

1.6.2

SEMANTIC 1 CVE

2.1.1

SEMANTIC 1 CVE

0

SINGLE_NUMBER 1 CVE

1.5.9

SEMANTIC 1 CVE

CVE-2024-3817

HashiCorp’s go-getter library is vulnerable to argument injection when executing Git to discover remote branches. This vulnerability does not affect the go-getter/v2 branch and package.

CRITICAL Apr 17, 2024

CVE-2023-0475

HashiCorp go-getter up to 1.6.2 and 2.1.1 is vulnerable to decompression bombs. Fixed in 1.7.0 and 2.2.0.

MEDIUM Feb 16, 2023