Vulnerability · Published Sep 15, 2026 · Assigned by HashiCorp
CVE-2026-88922Go-getter vulnerable to a privilege escalation issue in its archive decompression handling
Medium 6.7
In plain English
A medium-severity security flaw in Shared library from HashiCorp. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.1% (higher than 1% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
The go-getter library up to versions 1.8.8 and 2.2.3 is vulnerable to a privilege escalation issue in its archive decompression handling that may allow a crafted archive to cause extracted files to be created with elevated permission bits. Where extraction is performed by a privileged user, this may allow a local actor to obtain the privileges of the extracting process. This vulnerability (CVE-2026-88922) is fixed in go-getter 1.8.9 and 2.2.4.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian:12 | golang-github-hashicorp-go-getter | no fix listed | DEBIAN-CVE-2026-88922 |
| Debian:14 | golang-github-hashicorp-go-getter | 1.8.9-1 | DEBIAN-CVE-2026-88922 |
| Ubuntu:22.04:LTS | golang-github-hashicorp-go-getter | no fix listed | UBUNTU-CVE-2026-88922 |
| Ubuntu:24.04:LTS | golang-github-hashicorp-go-getter | no fix listed | UBUNTU-CVE-2026-88922 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| HashiCorp | Shared library | 1.0.1 – before 2.2.4 |
Weakness: CWE-281 · Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H