CVE-2024-6257: Hashicorp Go-Getter

High severity, CVSS 8.8. EPSS: 1% chance of exploitation in the next 30 days.

HashiCorp’s go-getter library can be coerced into executing Git update on an existing maliciously modified Git Configuration, potentially leading to arbitrary code execution.

Affected products

• Hashicorp Go-Getter: before 1.7.5 (fixed in 1.7.5)

Published 2024-06-25. Last modified 2026-06-17.