Security context
What an agent needs to avoid regressing past fixes and find the next vuln in this repo.
hashicorp/go-getter
main @ d7785c0
8
Fixes
9
CVEs
CRITICAL
Peak severity
0.0%
Coverage
Highlights
Information Disclosure: 2 prior fixes. Scrutinize any change in this area.
get_git.go: most-fixed (2 issues). Treat as high-risk during review.
5 high-severity fixes in this history; regressions here are high-impact.
Recurring patterns
The bug types that recur here, drawn from past fixes, not open vulnerabilities.
Command Injection: Insecure handling and insufficient validation of Git references allows malicious reference strings to be interpreted as options or commands, potentially leading to arbitrary remote code execution. This is a severe recurring theme for VCS getters.
Argument Injection: The git executable can process hyphen-prefixed strings intended as reference parameters (such as branch or tag names) as command-line flags. Without strict argument prefix validation, attackers can inject arbitrary flags during git execution.
Path Traversal: Path canonicalization and prefix checks can be bypassed if untrusted subdirectory paths, query strings, or nested symbolic links are not validated against the destination root. This allows directory escapes during write and copy operations.