Skip to content
Fencer Vulns
medium 6.7

CVE-2026-88922 json

Go-getter vulnerable to a privilege escalation issue in its archive decompression handling

published 2026-09-15 54 d ago modified 2026-09-20 50 d ago also EUVD-2026-79245

cvss
6.7
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
0.1%
EPSS 0.1% chance of exploitation in 30 days, percentile 1%
public exploits
0
none known

Summary

The go-getter library up to versions 1.8.8 and 2.2.3 is vulnerable to a privilege escalation issue in its archive decompression handling that may allow a crafted archive to cause extracted files to be created with elevated permission bits. Where extraction is performed by a privileged user, this may allow a local actor to obtain the privileges of the extracting process. This vulnerability (CVE-2026-88922) is fixed in go-getter 1.8.9 and 2.2.4.

Patch / fix

  • HashiCorp Shared library 1.8.9, 2.2.4
  • golang-github-hashicorp-go-getter Debian 14 1.8.9-1

debian advisories DEBIAN-CVE-2026-88922

  • trivy hummingbird 1 0.74.0-0.3.hum1
  • opentofu1.12 hummingbird 1 1.12.6-0.2.hum1
  • opentofu1.10 hummingbird 1 1.10.10-0.4.hum1
  • grype hummingbird 1 0.118.0-0.2.hum1
  • syft hummingbird 1 1.51.1-0.2.hum1

red hat advisories RHSA-2026:68281RHSA-2026:68261RHSA-2026:68259RHSA-2026:68255RHSA-2026:68251

  • terraform-provider-susepubliccloud SLE Module for Public Cloud 15 SP5, SLE Module for Public Cloud 15 SP4 0.0.1-150100.3.26.1

suse advisories SUSE-SU-2026:4444-1

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2026-88922 updated cvss 6.7

github.com/hashicorp/go-getter: Go-getter: Privilege escalation via crafted archive decompression

  • Red Hat Exploit Intelligence exploit-intelligence/agent-client-rhel9, exploit-intelligence-tech-preview/agent-client-rhel9
    affected: no fix planned “Out of support scope”
  • Red Hat Hardened Images opentofu1.11 1.11.14-0.1.hum1
    affected: no fix planned “Will not fix”
  • Red Hat Trusted Artifact Signer rhtas/ec-rhel9
    affected: no fix available “Fix deferred”
  • Red Hat Hardened Images syft 1.51.1-0.2.hum1, trivy 0.74.0-0.3.hum1, grype 0.118.0-0.2.hum1, opentofu1.12 1.12.6-0.2.hum1, opentofu1.10 1.10.10-0.4.hum1
    fixed: vendor fix RHSA-2026:68255

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation
none
Automatable
no
Technical impact
total
Assessed
50 d ago

Exploit prediction

0.11% chance of exploitation in the next 30 days, higher than 1% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
CNA 3.1 6.7 CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H

Affected products

  • HashiCorp Shared library

Classification

Weakness
  • CWE-281 Improper Preservation of Permissions

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.