CVE-2020-29529: Hashicorp Go-Slug

High severity, CVSS 7.5. EPSS: 2.8% chance of exploitation in the next 30 days.

HashiCorp go-slug up to 0.4.3 did not fully protect against directory traversal while unpacking tar archives, and protections could be bypassed with specific constructions of multiple symlinks. Fixed in 0.5.0.

Affected products

• Hashicorp Go-Slug: before 0.5.0 (fixed in 0.5.0)

Published 2020-12-03. Last modified 2026-06-17.