Description
HashiCorp’s go-getter library is vulnerable to argument injection when executing Git to discover remote branches.
This vulnerability does not affect the go-getter/v2 branch and package.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| HashiCorp | Shared library | 1.5.9 – < 1.7.3 | 1.7.3 |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | golang-github-hashicorp-go-getter | 1.8.9-1 | — |
| Debian 12 | golang-github-hashicorp-go-getter | No fix yet | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 25.10 | golang-github-hashicorp-go-getter | No fix yet | — |
| Ubuntu 24.04 LTS | golang-github-hashicorp-go-getter +1 | No fix yet | — |
| Ubuntu 22.04 LTS | golang-github-hashicorp-go-getter +1 | No fix yet | — |
| Ubuntu 20.04 LTS | golang-github-hashicorp-go-getter +1 | No fix yet | — |
| Ubuntu 18.04 LTS | golang-github-hashicorp-go-getter | No fix yet | — |
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SUSE Package Hub 15 SP6 | trivy | 0.58.2-bp156.2.6.1 | openSUSE-SU-2025:0056-1 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | trivy | 0.58.2-1.1 | openSUSE-SU-2025:14713-1 |
| openSUSE Leap 15.6 | trivy | 0.58.2-bp156.2.6.1 | openSUSE-SU-2025:0056-1 |
Azure Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Azure Linux 2 (CBL-Mariner) | terraform | 1.3.2-14 | — |
Wolfi
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Wolfi rolling | conftest | 0.52.0-r0 | — |
| Wolfi rolling | k9s | 0.32.4-r3 | — |
| Wolfi rolling | kubescape | 3.0.9-r0 | — |
| Wolfi rolling | terraform +2 | 1.5.7-r8 | — |
| Wolfi rolling | tflint | 0.51.0-r0 | — |
| Wolfi rolling | tfsec | 1.28.5-r3 | — |
| Wolfi rolling | zarf | 0.33.1-r1 | — |
| Wolfi rolling | zot | 2.0.4-r0 | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Go | github.com/hashicorp/go-getter | >= 1.5.9, < 1.7.4 | 1.7.4 | GHSA-q64h-39hv-4cf7 |
Advisories 2
- openSUSE-SU-2025:0056-1 Security update for trivy SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2025:14713-1 trivy-0.58.2-1.1 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026