What’s Vulnerable › Vulnerabilities
CVE-2026-88922: Go-getter vulnerable to a privilege escalation issue in its archive decompression handling
- Severity: medium (CVSS 6.7 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 0.1% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2026-09-15 · updated 2026-09-20
- Weakness: CWE-281
Description
The go-getter library up to versions 1.8.8 and 2.2.3 is vulnerable to a privilege escalation issue in its archive decompression handling that may allow a crafted archive to cause extracted files to be created with elevated permission bits. Where extraction is performed by a privileged user, this may allow a local actor to obtain the privileges of the extracting process. This vulnerability (CVE-2026-88922) is fixed in go-getter 1.8.9 and 2.2.4.
Affected products
- HashiCorp Shared library: from 1.0.1 before 2.2.4 — fixed in 2.2.4
How to fix
Upgrade to a fixed version: HashiCorp Shared library 2.2.4. Check the vendor advisory for mitigations.
References
Get alerted when CVE-2026-88922 or the next vulnerability affects your stack