CVE-2024-3817

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

HashiCorp’s go-getter library is vulnerable to argument injection when executing Git to discover remote branches.

This vulnerability does not affect the go-getter/v2 branch and package.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-88

Affected software

VendorProductVersions
HashiCorpShared library>= 1.5.9, < 1.7.3
hashicorpgo-getter>= 1.5.9, < 1.7.3

References

Timeline

Published
Apr 17, 2024
Last modified
Jun 17, 2026
NVD status
Analyzed

Related CVEs from 2024

CVE-2024-381707.1Microsoft Excel Remote Code Execution VulnerabilityCVE-2024-381717.8Microsoft PowerPoint Remote Code Execution VulnerabilityCVE-2024-381727.8Microsoft Excel Remote Code Execution VulnerabilityCVE-2024-381736.7Microsoft Outlook Remote Code Execution VulnerabilityCVE-2024-381758.8An improper access control vulnerability in the Azure Managed Instance for Apache Cassandra allows an authenticated attacker to elevate privCVE-2024-381768.1An improper restriction of excessive authentication attempts in GroupMe allows a unauthenticated attacker to elevate privileges over a netwoCVE-2024-381777.8Windows App Installer Spoofing VulnerabilityCVE-2024-381787.5Scripting Engine Memory Corruption VulnerabilityCVE-2024-381798.8Azure Stack Hyperconverged Infrastructure (HCI) Elevation of Privilege VulnerabilityCVE-2024-38185.4The Essential Blocks – Page Builder Gutenberg Blocks, Patterns & Templates plugin for WordPress is vulnerable to Stored Cross-Site ScriptingCVE-2024-381808.8Windows SmartScreen Security Feature Bypass VulnerabilityCVE-2024-381829.8Weak authentication in Microsoft Dynamics 365 allows an unauthenticated attacker to elevate privileges over a network.
CVE-2024-3817: Critical severity, CVSS 9.8 | Vulnix