CVE-2022-30321: Hashicorp Go-Getter

High severity, CVSS 8.6. EPSS: 3.3% chance of exploitation in the next 30 days.

go-getter up to 1.5.11 and 2.0.2 allowed arbitrary host access via go-getter path traversal, symlink processing, and command injection flaws. Fixed in 1.6.1 and 2.1.0.

Affected products

• Hashicorp Go-Getter: up to and including 1.5.11; version 2.0.2 only

Published 2022-05-25. Last modified 2026-06-17.