Update module github.com/hashicorp/go-getter to v1.8.6 [SECURITY]

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
github.com/hashicorp/go-getter	v1.6.1 → v1.8.6

---

Data Amplification in HashiCorp go-getter

CVE-2023-0475 / GHSA-jpxj-2jvg-6jv9 / GO-2023-1578

More information

Details

HashiCorp go-getter up to 1.6.2 and 2.1.1 is vulnerable to decompression bombs. Fixed in 1.7.0 and 2.2.0.

Severity

• CVSS Score: 4.2 / 10 (Medium)
• Vector String: CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:U/C:N/I:N/A:H

References

• https://nvd.nist.gov/vuln/detail/CVE-2023-0475
• https://github.com/hashicorp/go-getter/commit/0edab85348271c843782993345b07b1ac98912e6
• https://github.com/hashicorp/go-getter/commit/78e6721a2a76266718dc92c3c03c1571dffdefdc
• https://discuss.hashicorp.com/t/hcsec-2023-4-go-getter-vulnerable-to-denial-of-service-via-malicious-compressed-archive/50125
• https://github.com/hashicorp/go-getter

This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).

---

Denial of service in github.com/hashicorp/go-getter/v2

CVE-2023-0475 / GHSA-jpxj-2jvg-6jv9 / GO-2023-1578

More information

Details

HashiCorp go-getter is vulnerable to decompression bombs. This can lead to excessive memory consumption and denial-of-service attacks.

Severity

Unknown

References

• https://discuss.hashicorp.com/t/hcsec-2023-4-go-getter-vulnerable-to-denial-of-service-via-malicious-compressed-archive/50125
• https://github.com/hashicorp/go-getter/commit/0edab85348271c843782993345b07b1ac98912e6
• https://github.com/hashicorp/go-getter/commit/78e6721a2a76266718dc92c3c03c1571dffdefdc

This data is provided by OSV and the Go Vulnerability Database (CC-BY 4.0).

---

HashiCorp go-getter Vulnerable to Argument Injection When Fetching Remote Default Git Branches

CVE-2024-3817 / GHSA-q64h-39hv-4cf7 / GO-2024-2800

More information

Details

When go-getter is performing a Git operation, go-getter will try to clone the given repository. If a Git reference is not passed along with the Git url, go-getter will then try to check the remote repository’s HEAD reference of its default branch by passing arguments to the Git binary on the host it is executing on.

An attacker may format a Git URL in order to inject additional Git arguments to the Git call.

Consumers of the go-getter library should evaluate the risk associated with these issues in the context of their go-getter usage and upgrade go-getter to 1.7.4 or later.

Severity

• CVSS Score: 9.8 / 10 (Critical)
• Vector String: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References

• https://nvd.nist.gov/vuln/detail/CVE-2024-3817
• https://github.com/hashicorp/go-getter/commit/268c11cae8cf0d9374783e06572679796abe9ce9
• https://discuss.hashicorp.com/t/hcsec-2024-09-hashicorp-go-getter-vulnerable-to-argument-injection-when-fetching-remote-default-git-branches/66040
• https://github.com/hashicorp/go-getter

This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).

---

Argument injection when fetching remote default Git branches in github.com/hashicorp/go-getter

CVE-2024-3817 / GHSA-q64h-39hv-4cf7 / GO-2024-2800

More information

Details

When go-getter is performing a Git operation, go-getter will try to clone the given repository. If a Git reference is not passed along with the Git url, go-getter will then try to check the remote repository's HEAD reference of its default branch by passing arguments to the Git binary on the host it is executing on.

An attacker may format a Git URL in order to inject additional Git arguments to the Git call.

Severity

Unknown

References

• https://github.com/advisories/GHSA-q64h-39hv-4cf7
• https://github.com/hashicorp/go-getter/commit/268c11cae8cf0d9374783e06572679796abe9ce9
• https://discuss.hashicorp.com/t/hcsec-2024-09-hashicorp-go-getter-vulnerable-to-argument-injection-when-fetching-remote-default-git-branches/66040

This data is provided by OSV and the Go Vulnerability Database (CC-BY 4.0).

---

HashiCorp go-getter Vulnerable to Code Execution On Git Update Via Git Config Manipulation

CVE-2024-6257 / GHSA-xfhp-jf8p-mh5w / GO-2024-2948

More information

Details

HashiCorp’s go-getter library can be coerced into executing Git update on an existing maliciously modified Git Configuration, potentially leading to arbitrary code execution. When go-getter is performing a Git operation, go-getter will try to clone the given repository in a specified destination. Cloning initializes a git config to the provided destination and if the repository needs to get updated go-getter will pull the new changes .

An attacker may alter the Git config after the cloning step to set an arbitrary Git configuration to achieve code execution.

Severity

• CVSS Score: 8.4 / 10 (High)
• Vector String: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:H

References

• https://nvd.nist.gov/vuln/detail/CVE-2024-6257
• https://github.com/hashicorp/go-getter/commit/268c11cae8cf0d9374783e06572679796abe9ce9
• https://discuss.hashicorp.com/t/hcsec-2024-13-hashicorp-go-getter-vulnerable-to-code-execution-on-git-update-via-git-config-manipulation/68081
• https://github.com/advisories/GHSA-xfhp-jf8p-mh5w
• https://github.com/hashicorp/go-getter

This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).

---

Code Execution on Git update in github.com/hashicorp/go-getter

CVE-2024-6257 / GHSA-xfhp-jf8p-mh5w / GO-2024-2948

More information

Details

A crafted request can execute Git update on an existing maliciously modified Git Configuration. This can potentially lead to arbitrary code execution. When performing a Git operation, the library will try to clone the given repository to a specified destination. Cloning initializes a git config in the provided destination. An attacker may alter the Git config after the cloning step to set an arbitrary Git configuration to achieve code execution.

Severity

Unknown

References

• https://github.com/advisories/GHSA-xfhp-jf8p-mh5w
• https://github.com/hashicorp/go-getter/commit/268c11cae8cf0d9374783e06572679796abe9ce9
• https://discuss.hashicorp.com/t/hcsec-2024-13-hashicorp-go-getter-vulnerable-to-code-execution-on-git-update-via-git-config-manipulation/68081

This data is provided by OSV and the Go Vulnerability Database (CC-BY 4.0).

---

HashiCorp go-getter Vulnerable to Symlink Attacks

CVE-2025-8959 / GHSA-wjrx-6529-hcj3 / GO-2025-3892

More information

Details

HashiCorp's go-getter library subdirectory download feature is vulnerable to symlink attacks leading to unauthorized read access beyond the designated directory boundaries. This vulnerability, identified as CVE-2025-8959, is fixed in go-getter 1.7.9.

Severity

• CVSS Score: 7.5 / 10 (High)
• Vector String: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

References

• https://nvd.nist.gov/vuln/detail/CVE-2025-8959
• https://github.com/hashicorp/go-getter/commit/87541b2501c00df5eaedea6acc61a2a4a4efa5b7
• https://discuss.hashicorp.com/t/hcsec-2025-23-hashicorp-go-getter-vulnerable-to-arbitrary-read-through-symlink-attack/76242
• https://github.com/hashicorp/go-getter
• https://pkg.go.dev/vuln/GO-2025-3892

This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).

---

HashiCorp go-getter Vulnerable to Symlink Attacks in github.com/hashicorp/go-getter

CVE-2025-8959 / GHSA-wjrx-6529-hcj3 / GO-2025-3892

More information

Details

HashiCorp go-getter Vulnerable to Symlink Attacks in github.com/hashicorp/go-getter

Severity

Unknown

References

• https://github.com/advisories/GHSA-wjrx-6529-hcj3
• https://github.com/hashicorp/go-getter/commit/87541b2501c00df5eaedea6acc61a2a4a4efa5b7
• https://discuss.hashicorp.com/t/hcsec-2025-23-hashicorp-go-getter-vulnerable-to-arbitrary-read-through-symlink-attack/76242

This data is provided by OSV and the Go Vulnerability Database (CC-BY 4.0).

---

HashiCorp's go-getter library may allow arbitrary file reads

CVE-2026-4660 / GHSA-92mm-2pjq-r785 / GO-2026-5058

More information

Details

HashiCorp's go-getter library up to v1.8.5 may allow arbitrary file reads on the file system during certain git operations through a maliciously crafted URL. This is fixed in go-getter v1.8.6. This vulnerability does not affect the go-getter/v2 branch and package.

Severity

• CVSS Score: 7.5 / 10 (High)
• Vector String: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

References

• https://nvd.nist.gov/vuln/detail/CVE-2026-4660
• https://discuss.hashicorp.com/t/hcsec-2026-04-go-getter-may-allow-to-arbitrary-filesystem-reads-through-git-operations/77311
• https://github.com/hashicorp/go-getter

This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).

---

HashiCorp's go-getter library may allow arbitrary file reads in github.com/hashicorp/go-getter

CVE-2026-4660 / GHSA-92mm-2pjq-r785 / GO-2026-5058

More information

Details

HashiCorp's go-getter library up to v1.8.5 may allow arbitrary file reads on the file system during certain git operations through a maliciously crafted URL. This is fixed in go-getter v1.8.6. This vulnerability does not affect the go-getter/v2 branch and package.

Severity

Unknown

References

• https://github.com/advisories/GHSA-92mm-2pjq-r785
• https://discuss.hashicorp.com/t/hcsec-2026-04-go-getter-may-allow-to-arbitrary-filesystem-reads-through-git-operations/77311

This data is provided by OSV and the Go Vulnerability Database (CC-BY 4.0).

---

Release Notes

hashicorp/go-getter (github.com/hashicorp/go-getter)

v1.8.6

Compare Source

v1.8.5

Compare Source

What's Changed

• [chore] : Bump the go group with 2 updates by @​dependabot[bot] in #​576
• use %w to wrap error by @​Ericwww in #​475
• fix: #​538 http file download skipped if headResp.ContentLength is 0 by @​martijnvdp in #​539
• chore: fix error message capitalization in checksum function by @​ssagarverma in #​578
• [chore] : Bump the go group with 8 updates by @​dependabot[bot] in #​577
• Fix git url with ambiguous ref by @​nimasamii in #​382
• fix: resolve compilation errors in get_git_test.go by @​CreatorHead in #​579
• [chore] : Bump the actions group with 2 updates by @​dependabot[bot] in #​582
• [chore] : Bump the go group with 3 updates by @​dependabot[bot] in #​583
• test that arbitrary files cannot be checksummed by @​schmichael in #​250
• [chore] : Bump google.golang.org/api from 0.260.0 to 0.262.0 in the go group by @​dependabot[bot] in #​585
• [chore] : Bump actions/checkout from 6.0.1 to 6.0.2 in the actions group by @​dependabot[bot] in #​586
• [chore] : Bump the go group with 3 updates by @​dependabot[bot] in #​588
• [chore] : Bump actions/cache from 5.0.2 to 5.0.3 in the actions group by @​dependabot[bot] in #​589
• [chore] : Bump aws-actions/configure-aws-credentials from 5.1.1 to 6.0.0 in the actions group by @​dependabot[bot] in #​592
• [chore] : Bump google.golang.org/api from 0.264.0 to 0.265.0 in the go group by @​dependabot[bot] in #​591
• [chore] : Bump the go group with 5 updates by @​dependabot[bot] in #​593
• IND-6310 - CRT Onboarding by @​nasareeny in #​584
• Fix crt build path by @​ssagarverma in #​594
• [chore] : Bump the go group with 3 updates by @​dependabot[bot] in #​596
• fix: remove checkout action from set-product-version job by @​ssagarverma in #​598
• [chore] : Bump the actions group with 4 updates by @​dependabot[bot] in #​595
• fix(deps): upgrade go.opentelemetry.io/otel/sdk to v1.40.0 (GO-2026-4394) by @​ssagarverma in #​599
• Prepare go-getter for v1.8.5 release by @​nasareeny in #​597
• [chore] : Bump the actions group with 2 updates by @​dependabot[bot] in #​600
• sec: bump go and xrepos + redact aws tokens in url by @​dduzgun-security in #​604

NOTES:

Binary Distribution Update: To streamline our release process and align with other HashiCorp tools, all release binaries will now be published exclusively to the official HashiCorp release site. We will no longer attach release assets to GitHub Releases.

New Contributors

• @​Ericwww made their first contribution in #​475
• @​martijnvdp made their first contribution in #​539
• @​nimasamii made their first contribution in #​382
• @​nasareeny made their first contribution in #​584

Full Changelog: hashicorp/go-getter@v1.8.4...v1.8.5

v1.8.4

Compare Source

What's Changed

• [IND-4227][COMPLIANCE] chore: Fix lint issues-build tags by @​ssagarverma in #​568
• [IND-4227] [COMPLIANCE] Update Copyright Headers by @​oss-core-libraries-dashboard[bot] in #​566
• [COMPLIANCE] Update Copyright Headers by @​oss-core-libraries-dashboard[bot] in #​571
• [chore] : Bump the actions group across 1 directory with 3 updates by @​dependabot[bot] in #​567
• fix: allow downloading S3 files from MinIO over http by @​vsarunas in #​570
• [chore] : Bump the actions group across 1 directory with 6 updates by @​dependabot[bot] in #​574
• [chore] : Bump the go group across 1 directory with 12 updates by @​dependabot[bot] in #​575

New Contributors

• @​ssagarverma made their first contribution in #​568
• @​oss-core-libraries-dashboard[bot] made their first contribution in #​566

Full Changelog: hashicorp/go-getter@v1.8.3...v1.8.4

v1.8.3

Compare Source

What's Changed

• [chore] : Bump actions/cache from 4.2.4 to 4.3.0 in the actions group by @​dependabot[bot] in #​562
• [chore] : Bump aws-actions/configure-aws-credentials from 5.0.0 to 5.1.0 in the actions group by @​dependabot[bot] in #​563
• Remove failed decompressed files by @​allisonlarson in #​564

New Contributors

• @​allisonlarson made their first contribution in #​564

Full Changelog: hashicorp/go-getter@v1.8.2...v1.8.3

v1.8.2

Compare Source

What's Changed

• Ensure temporary directory symlinks do not cause errors by @​cam-stitt in #​560

New Contributors

• @​cam-stitt made their first contribution in #​560

Full Changelog: hashicorp/go-getter@v1.8.1...v1.8.2

v1.8.1

Compare Source

What's Changed

• chore(deps): bump ulikunitz/xz to v0.5.15 by @​thevilledev in #​550
• Improve CI/CD, fix tests by @​YakDriver in #​554
• [fix] Windows junction handling by @​YakDriver in #​557

New Contributors

• @​thevilledev made their first contribution in #​550

Full Changelog: hashicorp/go-getter@v1.8.0...v1.8.1

v1.8.0

What's Changed

• [chore] : Bump the actions group with 2 updates by @​dependabot[bot] in #​543
• [chore] : Bump google-github-actions/auth from 2.1.12 to 3.0.0 in the actions group by @​dependabot[bot] in #​546
• go: bump ulikunitz/xz to v.0.5.14 to resolve GHSA-jc7w-c686-c4v9 by @​ryancragun in #​547
• Upgrade to aws-sdk-go-v2, v1 is unsupported by @​YakDriver in #​548
• Modernize codebase: Fix linting issues, update CI/CD workflow, and improve test categorization by @​YakDriver in #​549

New Contributors

• @​ryancragun made their first contribution in #​547
• @​YakDriver made their first contribution in #​548

Full Changelog: hashicorp/go-getter@v1.7.9...v1.8.0

v1.7.9

Compare Source

What's Changed

• Speed up XZ decompression by 5x with bufio wrapper by @​vsarunas in #​520
• Fix CI Workflow by @​mohanmanikanta2299 in #​522
• test: Remove use of "mitchellh/go-testing-interface" for stdlib by @​jrasell in #​523
• fix: url redact of multiple sshkey by @​dduzgun-security in #​528
• Publish arm binaries by @​sethvargo in #​525
• fix errcheck lint errors and run it as part of pr checks by @​abhijeetviswa in #​530
• fix additional lint errors and increase linter scope by @​abhijeetviswa in #​531
• IND-3728 enabling dependabot by @​KaushikiAnand in #​529
• fix: go-getter subdir paths by @​dduzgun-security in #​540

New Contributors

• @​vsarunas made their first contribution in #​520
• @​jrasell made their first contribution in #​523
• @​sethvargo made their first contribution in #​525
• @​abhijeetviswa made their first contribution in #​530
• @​KaushikiAnand made their first contribution in #​529

Full Changelog: hashicorp/go-getter@v1.7.8...v1.7.9

v1.7.8

Compare Source

What's Changed

• sec: fix s3 and gcs host checks by @​dduzgun-security in #​512

Full Changelog: hashicorp/go-getter@v1.7.7...v1.7.8

v1.7.7

Compare Source

What's Changed

• Clean up git repo on disk when the ref checkout fails by @​james-warren0 in #​504
• [COMPLIANCE] Add Copyright and License Headers by @​hashicorp-copywrite in #​409
• Add CODEOWNERS file in .github/CODEOWNERS by @​mukeshjc in #​505
• IND-1804 Bump up dependencies to remediate vulnerabiities by @​mohanmanikanta2299 in #​513
• Updating arguments in github release CI by @​mohanmanikanta2299 in #​514
• Updating .goreleaser.yml file with valid version by @​mohanmanikanta2299 in #​515

New Contributors

• @​james-warren0 made their first contribution in #​504
• @​mukeshjc made their first contribution in #​505
• @​mohanmanikanta2299 made their first contribution in #​513

Full Changelog: hashicorp/go-getter@v1.7.6...v1.7.7

v1.7.6

Compare Source

What's Changed

• fix: Avoid panic when s3 URL is invalid by @​liamg in #​501

New Contributors

• @​liamg made their first contribution in #​501

Full Changelog: hashicorp/go-getter@v1.7.5...v1.7.6

v1.7.5

Compare Source

What's Changed

• Prevent Git Config Alteration on Git Update by @​dduzgun-security in #​497

New Contributors

• @​dduzgun-security made their first contribution in #​497

Full Changelog: hashicorp/go-getter@v1.7.4...v1.7.5

v1.7.4

Compare Source

What's Changed

• Escape user-provided strings in git commands #​483
• Fixed a bug in .netrc handling if the file does not exist #​433

Full Changelog: hashicorp/go-getter@v1.7.3...v1.7.4

v1.7.3

Compare Source

What's Changed

• SEC-090: Automated trusted workflow pinning (2023-04-21) by @​hashicorp-tsccr in #​432
• SEC-090: Automated trusted workflow pinning (2023-09-11) by @​hashicorp-tsccr in #​454
• SEC-090: Automated trusted workflow pinning (2023-09-18) by @​hashicorp-tsccr in #​458
• don't change GIT_SSH_COMMAND when there is no sshKeyFile by @​jbardin in #​459

New Contributors

• @​hashicorp-tsccr made their first contribution in #​432

Full Changelog: hashicorp/go-getter@v1.7.2...v1.7.3

v1.7.2

Compare Source

What's Changed

• Don't override GIT_SSH_COMMAND when not needed by @​nl-brett-stime #​300

Full Changelog: hashicorp/go-getter@v1.7.1...v1.7.2

v1.7.1

Compare Source

v1.7.0

Compare Source

What's Changed

• docs: provide logging recommendations by @​mickael-hc in #​371
• Update aws sdk version by @​Jukie in #​384
• Update S3 URL in README by @​twelvelabs in #​378
• Migrate to GHA by @​claire-labry in #​379
• [COMPLIANCE] Update MPL 2.0 LICENSE by @​hashicorp-copywrite in #​386
• remove codesign entirely from go-getter by @​claire-labry in #​408
• Add decompression bomb mitigation options for v1 by @​picatz in #​412
• v1: decompressors: add LimitedDecompressors helper by @​shoenig in #​413

New Contributors

• @​mickael-hc made their first contribution in #​371
• @​Jukie made their first contribution in #​384
• @​twelvelabs made their first contribution in #​378
• @​hashicorp-copywrite made their first contribution in #​386

Full Changelog: hashicorp/go-getter@v1.6.2...v1.7.0

v1.6.2

Compare Source

What's Changed

• Fix no getter available for X-Terraform-Get source protocol when using bare github or bitbucket hostnames: #​370

---

Configuration

📅 Schedule: (in timezone Asia/Tokyo)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[renovate]

ℹ️ Artifact update notice

File name: go.mod

In order to perform the update(s) described in the table above, Renovate ran the go get command, which resulted in the following additional change(s):

• 16 additional dependencies were updated
• The go directive was updated for compatibility reasons

Details:

Package	Change
go	1.25.0 -> 1.25.8
golang.org/x/oauth2	v0.27.0 -> v0.36.0
cloud.google.com/go	v0.105.0 -> v0.123.0
github.com/cespare/xxhash/v2	v2.1.2 -> v2.3.0
github.com/davecgh/go-spew	v1.1.1 -> v1.1.2-0.20180830191138-d8f796af33cc
github.com/google/uuid	v1.3.0 -> v1.6.0
github.com/googleapis/enterprise-certificate-proxy	v0.2.0 -> v0.3.14
github.com/googleapis/gax-go/v2	v2.7.0 -> v2.17.0
github.com/hashicorp/go-version	v1.5.0 -> v1.8.0
github.com/klauspost/compress	v1.15.11 -> v1.18.5
github.com/pmezard/go-difflib	v1.0.0 -> v1.0.1-0.20181226105442-5d4384ee4fb2
github.com/prometheus/client_model	v0.3.0 -> v0.6.2
github.com/ulikunitz/xz	v0.5.10 -> v0.5.15
google.golang.org/api	v0.103.0 -> v0.271.0
google.golang.org/genproto	v0.0.0-20221202195650-67e5cbc046fd -> v0.0.0-20260128011058-8636f8732409
google.golang.org/grpc	v1.51.0 -> v1.79.3
google.golang.org/protobuf	v1.33.0 -> v1.36.11