Hashicorp Go-Slug vulnerabilities

3 CVEs affecting Hashicorp Go-Slug, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2026-14978, published 2026-08-19.

More from Hashicorp.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

• CVE-2020-29529, published 2020-12-03. High severity, CVSS 7.5. EPSS: 2.8% chance of exploitation in the next 30 days. HashiCorp go-slug up to 0.4.3 did not fully protect against directory traversal while unpacking tar archives, and protections could be bypassed with specific constructions of multiple symlinks. Fixed…
• CVE-2025-0377, published 2025-01-21. Critical severity, CVSS 9.1. EPSS: 0.7% chance of exploitation in the next 30 days. HashiCorp’s go-slug library is vulnerable to a zip-slip style attack when a non-existing user-provided path is extracted from the tar entry.
• CVE-2026-14978, published 2026-08-19. Medium severity, CVSS 5.5. EPSS: 0.1% chance of exploitation in the next 30 days. HashiCorp go-slug 0.4.0 through 0.18.2 could allow a local attacker to bypass .terraformignore exclusions and cause sensitive files to be included in Terraform slug uploads due to improper handling…