CVE-2024-3817: Hashicorp Go-Getter

Critical severity, CVSS 9.8. EPSS: 1.3% chance of exploitation in the next 30 days.

HashiCorp’s go-getter library is vulnerable to argument injection when executing Git to discover remote branches. This vulnerability does not affect the go-getter/v2 branch and package.

Affected products

• Hashicorp Go-Getter: from 1.5.9, before 1.7.4 (fixed in 1.7.4)

Published 2024-04-17. Last modified 2026-06-17.