Bulletin ID: HCSEC-2026-39
Affected Products / Versions: Go-getter up to 1.8.8 and 2.2.3; fixed in go-getter 1.8.9 and 2.2.4
Publication Date: September 15, 2026
Summary
The go-getter library up to versions 1.8.8 and 2.2.3 is vulnerable to a privilege escalation issue in its archive decompression handling that may allow a crafted archive to cause extracted files to be created with elevated permission bits. Where extraction is performed by a privileged user, this may allow a local actor to obtain the privileges of the extracting process. This vulnerability (CVE-2026-88922) is fixed in go-getter 1.8.9 and 2.2.4.
Background
Go-getter is a library for downloading files and directories from a variety of sources, and is used to retrieve artifacts such as modules, plugins, and job artifacts. When a downloaded artifact is an archive, go-getter detects the archive format and extracts its contents into a destination directory, recreating the files, directories, and file metadata that the archive describes.
Details
Go-getter applied the permission metadata recorded in archive entries to the files it extracted, without restricting that metadata to standard read, write, and execute permissions. An archive from an untrusted or attacker influenced source could therefore cause files to be created with elevated permission bits, which a local actor with access to the destination path may be able to use to obtain the privileges of the account that performed the extraction. Applications that extract only trusted archives, or that extract as an unprivileged user into a destination other local users cannot reach, are not meaningfully exposed.
Remediation
Customers should evaluate the risk associated with this issue and consider upgrading to go-getter 1.8.9 or 2.2.4. Following the upgrade, files extracted from archives retain only standard read, write, and execute permissions, so applications that relied on archives supplying additional permission bits will observe a change in behavior.
Acknowledgement
This issue was reported to HashiCorp by Kris Kennaway.
We deeply appreciate any effort to coordinate disclosure of security vulnerabilities. For information about security at HashiCorp and the reporting of security vulnerabilities, please see https://hashicorp.com/security.