github.com/hashicorp/go-slug

2 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

2 results · Clear filters · Feed

High 7.5

CVE-2025-0377

HashiCorp go-slug Vulnerable to Zip Slip Attack

HashiCorp’s go-slug library is vulnerable to a zip-slip style attack when a non-existing user-provided path is extracted from the tar entry.

HashiCorp Shared library github.com/hashicorp/go-slug Go

Jan 21, 2025
High 7.5

CVE-2020-29529

Unsafe tar unpacking in HashiCorp go-slug

HashiCorp go-slug up to 0.4.3 did not fully protect against directory traversal while unpacking tar archives, and protections could be bypassed with specific constructions of multiple symlinks. Fixed in 0.5.0.

github.com/hashicorp/go-slug golang-github-hashicorp-go-slug Debian Go

Dec 3, 2020