[Git][security-tracker-team/security-tracker][master] Add CVE-2026-88922/golang-github-hashicorp-go-getter

[Salvatore Bonaccorso (@carnil)]

Salvatore Bonaccorso pushed to branch master at Debian Security Tracker / security-tracker


Commits:
1d41e01a by Salvatore Bonaccorso at 2026-09-19T07:53:09+02:00
Add CVE-2026-88922/golang-github-hashicorp-go-getter

- - - - -


1 changed file:

- data/CVE/list


Changes:

=====================================
data/CVE/list
=====================================
@@ -4716,7 +4716,8 @@ CVE-2026-88976 (Plate is a rich-text editor with AI and shadcn/ui. Prior to 53.3
 CVE-2026-88975 (Http4s is a Scala interface for HTTP services. Prior to 0.23.37 and 1. ...)
 	NOT-FOR-US: Http4s
 CVE-2026-88922 (The go-getter library up to versions 1.8.8 and 2.2.3 is vulnerable to  ...)
-	TODO: check
+	- golang-github-hashicorp-go-getter <removed>
+	NOTE: https://discuss.hashicorp.com/t/hcsec-2026-39-go-getter-vulnerable-to-a-privilege-escalation-issue-in-its-archive-decompression-handling/77752
 CVE-2026-88910 (The kboard WordPress plugin before 6.7 does not verify ownership or co ...)
 	NOT-FOR-US: WordPress plugin
 CVE-2026-88817 (An authenticated, non-guest user of Curiosity Workspace could enroll t ...)



View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/1d41e01acb1a9bd98ab0ae64a81d2d908788a861

-- 
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/1d41e01acb1a9bd98ab0ae64a81d2d908788a861
You're receiving this email because of your account on salsa.debian.org. Manage all notifications: https://salsa.debian.org/-/profile/notifications | Help: https://salsa.debian.org/help


-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/debian-security-tracker-commits/attachments/20260919/afbe8ca7/attachment.htm>