REDHAT-BUG-2456909: High severity go-getter vulnerability

Q: Which versions are affected and which are not?

go-getter versions up to and including v1.8.5 are affected. The issue is fixed in v1.8.6, and the go-getter/v2 branch and package are not affected.

Q: What does an attacker need to exploit this issue?

An attacker needs to cause a vulnerable go-getter installation to perform certain Git operations using a maliciously crafted URL. Successful exploitation may allow arbitrary reads of files from the filesystem.

Q: What should be done if the affected library is in use?

Update go-getter to v1.8.6 or later. If the application uses the go-getter/v2 branch or package, this specific vulnerability does not apply.

Published Apr 9, 2026

Updated

HashiCorp’s go-getter library up to v1.8.5 may allow arbitrary file reads on the file system during certain git operations through a maliciously crafted URL. This vulnerability, CVE-2026-4660, is fixed in go-getter v1.8.6. This vulnerability does not affect the go-getter/v2 branch and package.

Affected Software

1 affected component

go-getter<=1.8.5

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade go-getter to a version that resolves this vulnerability.
Fixed in 1.8.6Patch CVE-2026-4660

Event History

Apr 9, 2026

Data Sourced

via Red Hat·03:01 PM

DescriptionSeverityAffected Software

Frequently Asked Questions

Which versions are affected and which are not?

go-getter versions up to and including v1.8.5 are affected. The issue is fixed in v1.8.6, and the go-getter/v2 branch and package are not affected.

What does an attacker need to exploit this issue?

An attacker needs to cause a vulnerable go-getter installation to perform certain Git operations using a maliciously crafted URL. Successful exploitation may allow arbitrary reads of files from the filesystem.

What should be done if the affected library is in use?

Update go-getter to v1.8.6 or later. If the application uses the go-getter/v2 branch or package, this specific vulnerability does not apply.

REDHAT-BUG-2456909: High severity go-getter vulnerability

Affected Software

Remediation

Event History

Frequently Asked Questions

Which versions are affected and which are not?

What does an attacker need to exploit this issue?

What should be done if the affected library is in use?

Company

Resources

Contact

Frequently Asked Questions

Which versions are affected and which are not?

What does an attacker need to exploit this issue?

What should be done if the affected library is in use?