CVE-2026-4660: HashiCorp's go-getter library may allow arbitrary file reads

April 9, 2026 (updated April 10, 2026)

HashiCorp’s go-getter library up to v1.8.5 may allow arbitrary file reads on the file system during certain git operations through a maliciously crafted URL. This is fixed in go-getter v1.8.6. This vulnerability does not affect the go-getter/v2 branch and package.

References

discuss.hashicorp.com/t/hcsec-2026-04-go-getter-may-allow-to-arbitrary-filesystem-reads-through-git-operations/77311
github.com/advisories/GHSA-92mm-2pjq-r785
github.com/hashicorp/go-getter
nvd.nist.gov/vuln/detail/CVE-2026-4660

Code Behaviors & Features

Detect and mitigate CVE-2026-4660 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →