CVE-2026-88922 — Go-getter vulnerable to a privilege escalation issue in its archive decompression handling

CVE-2026-88922

Go-getter vulnerable to a privilege escalation issue in its archive decompression handling PUBLISHED

Description (CNA)

The go-getter library up to versions 1.8.8 and 2.2.3 is vulnerable to a privilege escalation issue in its archive decompression handling that may allow a crafted archive to cause extracted files to be created with elevated permission bits. Where extraction is performed by a privileged user, this may allow a local actor to obtain the privileges of the extracting process. This vulnerability (CVE-2026-88922) is fixed in go-getter 1.8.9 and 2.2.4.

Affected (CNA)

Vendor / product	Versions
HashiCorp / Shared library	affected 1.0.1 before 2.2.4

CWE

CWE-281

References

https://discuss.hashicorp.com/t/hcsec-2026-39-go-getter-vulnerable-to-a-privilege-escalation-issue-in-its-archive-decompression-handling/77752

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.