Hashicorp Shared Library vulnerabilities

5 CVEs affecting Hashicorp Shared Library, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2026-19585, published 2026-10-08.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2026-0969, published 2026-02-12. High severity, CVSS 8.8. EPSS: 0.6% chance of exploitation in the next 30 days. The serialize function used to compile MDX in next-mdx-remote is vulnerable to arbitrary code execution due to insufficient sanitization of MDX content. This vulnerability, CVE-2026-0969, is fixed in…
CVE-2026-14362, published 2026-07-08. Medium severity, CVSS 4.9. EPSS: 0.4% chance of exploitation in the next 30 days. HashiCorp memberlist before version 0.6.0 is vulnerable to a denial-of-service issue in its push/pull state handling that may allow an attacker with network access to the gossip port to exhaust…
CVE-2026-19585, published 2026-10-08. Medium severity, CVSS 5.3. EPSS: 0.2% chance of exploitation in the next 30 days. HashiCorp go-getter versions before 1.8.10 and go-getter/v2 versions before 2.2.5 are vulnerable to path traversal during S3 and GCS directory downloads, which may allow files to be written outside…
CVE-2026-8052, published 2026-05-12. Medium severity, CVSS 6.0. EPSS: 0.2% chance of exploitation in the next 30 days. HashiCorp Nomad’s exec2 task driver prior to 0.1.2 is vulnerable to arbitrary file read and write on the client host as the Nomad process user through a symlink attack. This vulnerability…
CVE-2026-88922, published 2026-09-15. Medium severity, CVSS 6.7. EPSS: 0.1% chance of exploitation in the next 30 days. The go-getter library up to versions 1.8.8 and 2.2.3 is vulnerable to a privilege escalation issue in its archive decompression handling that may allow a crafted archive to cause extracted files to…