Hashicorp Shared Library vulnerabilities

CVE-2026-0969 [HIGH] CWE-94 CVE-2026-0969: The serialize function used to compile MDX in next-mdx-remote is vulnerable to arbitrary code execut The serialize function used to compile MDX in next-mdx-remote is vulnerable to arbitrary code execution due to insufficient sanitization of MDX content. This vulnerability, CVE-2026-0969, is fixed in next-mdx-remote 6.0.0.

CVE-2025-8959 [HIGH] CWE-59 CVE-2025-8959: HashiCorp's go-getter library subdirectory download feature is vulnerable to symlink attacks leading HashiCorp's go-getter library subdirectory download feature is vulnerable to symlink attacks leading to unauthorized read access beyond the designated directory boundaries. This vulnerability, identified as CVE-2025-8959, is fixed in go-getter 1.7.9.

CVE-2025-0377 [CRITICAL] CWE-59 CVE-2025-0377: HashiCorp’s go-slug library is vulnerable to a zip-slip style attack when a non-existing user-provid HashiCorp’s go-slug library is vulnerable to a zip-slip style attack when a non-existing user-provided path is extracted from the tar entry.

CVE-2024-6257 [HIGH] CWE-77 CVE-2024-6257: HashiCorp’s go-getter library can be coerced into executing Git update on an existing maliciously mo HashiCorp’s go-getter library can be coerced into executing Git update on an existing maliciously modified Git Configuration, potentially leading to arbitrary code execution.

CVE-2024-6104 [MEDIUM] CWE-532 CVE-2024-6104: go-retryablehttp prior to 0.7.7 did not sanitize urls when writing them to its log file. This could go-retryablehttp prior to 0.7.7 did not sanitize urls when writing them to its log file. This could lead to go-retryablehttp writing sensitive HTTP basic auth credentials to its log file. This vulnerability, CVE-2024-6104, was fixed in go-retryablehttp 0.7.7.

CVE-2024-3817 [CRITICAL] CWE-88 CVE-2024-3817: HashiCorp’s go-getter library is vulnerable to argument injection when executing Git to discover rem HashiCorp’s go-getter library is vulnerable to argument injection when executing Git to discover remote branches. This vulnerability does not affect the go-getter/v2 branch and package.