CVE-2026-88922

MediumCVSS 6.7/10Last modified Sep 20, 2026

Description

The go-getter library up to versions 1.8.8 and 2.2.3 is vulnerable to a privilege escalation issue in its archive decompression handling that may allow a crafted archive to cause extracted files to be created with elevated permission bits. Where extraction is performed by a privileged user, this may allow a local actor to obtain the privileges of the extracting process. This vulnerability (CVE-2026-88922) is fixed in go-getter 1.8.9 and 2.2.4.

Metrics

CVSS 3.1 6.7/10CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-281

Affected software

Vendor	Product	Versions
HashiCorp	Shared library	>= 1.0.1, < 2.2.4

References

https://discuss.hashicorp.com/t/hcsec-2026-39-go-getter-vulnerable-to-a-privilege-escalation-issue-in-its-archive-decompression-handling/77752

Timeline

Published: Sep 15, 2026
Last modified: Sep 20, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-889247.0A flaw was found in the admin backend of gvfs. The privileged gvfsd-admin daemon changes the ownership of newly created private D-Bus socket CVE-2026-889268.6The VikRentItems Flexible Rental Management System WordPress plugin before 1.2.4 does not sanitise and escape some of its parameters before CVE-2026-889274.3The rtMedia for WordPress, BuddyPress and bbPress WordPress plugin before 4.7.14 does not verify that a user owns or may write to the album CVE-2026-889286.5The PAYCOMET for WooCommerce WordPress plugin before 5.46 does not verify the cryptographic signature on its payment notification endpoint w CVE-2026-889295.3The Product Badge, Label, Countdown Timer for WooCommerce WordPress plugin before 7.5.2 does not check whether a product is published befor CVE-2026-88936.4The Express Payment For Stripe plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'type' attribute of the [stripe-exp CVE-2026-889308.6The Social Web Suite WordPress plugin through 4.1.12 does not require its shared secret to be set before accepting requests authorised by i CVE-2026-889315.3The Social Web Suite WordPress plugin through 4.1.12 does not restrict which of its settings may be written through an unauthenticated endp CVE-2026-889325.3multer is a Node.js middleware for handling multipart/form-data uploads. In versions 2.2.0 through 2.3.0, when a request using disk storage CVE-2026-889378.8knowns through 0.33.0 fails to properly validate template destination paths in the code generation template engine, allowing attackers to re CVE-2026-889386.5knowns through 0.33.0 fails to confine the path argument of the code.find MCP tool to the project root, allowing AI agent sessions to read s CVE-2026-889398.3knowns through 0.33.0 exempts the project.set action from permission guard checks unconditionally, allowing read-only agent sessions to bypa