CVE-2026-88922: Hashicorp Shared Library

Medium severity, CVSS 6.7. EPSS: 0.1% chance of exploitation in the next 30 days.

The go-getter library up to versions 1.8.8 and 2.2.3 is vulnerable to a privilege escalation issue in its archive decompression handling that may allow a crafted archive to cause extracted files to be created with elevated permission bits. Where extraction is performed by a privileged user, this may allow a local actor to obtain the privileges of the extracting process. This vulnerability (CVE-2026-88922) is fixed in go-getter 1.8.9 and 2.2.4.

Affected products

• Hashicorp Shared Library: from 1.0.1, before 2.2.4 (fixed in 2.2.4)

Published 2026-09-15. Last modified 2026-09-20.