First day on Intigriti: our agent harness found and proved a remote code execution bug, paid €3,000.

CVE-2024-3817

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

HashiCorp’s go-getter library is vulnerable to argument injection when executing Git to discover remote branches.

This vulnerability does not affect the go-getter/v2 branch and package.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

Affected software

No affected versions have been published.

Timeline

Published: Apr 17, 2024
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2024

CVE-2024-381707.1Microsoft Excel Remote Code Execution Vulnerability CVE-2024-381717.8Microsoft PowerPoint Remote Code Execution Vulnerability CVE-2024-381727.8Microsoft Excel Remote Code Execution Vulnerability CVE-2024-381736.7Microsoft Outlook Remote Code Execution Vulnerability CVE-2024-381758.8An improper access control vulnerability in the Azure Managed Instance for Apache Cassandra allows an authenticated attacker to elevate priv CVE-2024-381768.1An improper restriction of excessive authentication attempts in GroupMe allows a unauthenticated attacker to elevate privileges over a netwo CVE-2024-381777.8Windows App Installer Spoofing Vulnerability CVE-2024-381787.5Scripting Engine Memory Corruption Vulnerability CVE-2024-381798.8Azure Stack Hyperconverged Infrastructure (HCI) Elevation of Privilege Vulnerability CVE-2024-38185.4The Essential Blocks – Page Builder Gutenberg Blocks, Patterns & Templates plugin for WordPress is vulnerable to Stored Cross-Site Scripting CVE-2024-381808.8Windows SmartScreen Security Feature Bypass Vulnerability CVE-2024-381829.8Weak authentication in Microsoft Dynamics 365 allows an unauthenticated attacker to elevate privileges over a network.