VYPR
← All advisories
High severity7.5NVD Advisory· Published Apr 9, 2026· Updated Apr 13, 2026

CVE-2026-4660

CVE-2026-4660

Description

HashiCorp’s go-getter library up to v1.8.5 may allow arbitrary file reads on the file system during certain git operations through a maliciously crafted URL. This vulnerability, CVE-2026-4660, is fixed in go-getter v1.8.6. This vulnerability does not affect the go-getter/v2 branch and package.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
github.com/hashicorp/go-getterGo
< 1.8.61.8.6

Affected products

81

Patches

Vulnerability mechanics

References

3

News mentions

0

No linked articles in our index yet.