Arbitrary Host Access in Go-Getter by HashiCorp

CVE-2022-30321

Summary

The Go-Getter library versions 1.5.11 and 2.0.2 are susceptible to critical security flaws including arbitrary host access through path traversal, symlink processing, and command injection vulnerabilities. These weaknesses allow malicious actors to execute unauthorized commands and gain access to sensitive data. Upgrading to the fixed versions 1.6.1 and 2.1.0 is crucial for maintaining the security of applications utilizing the Go-Getter library.

References