HCSEC-2026-39 - Go-getter vulnerable to a privilege escalation issue in its archive decompression handling

{
  "id": "3805c840d507302c74a4547706634e27b132cbec88842d947ce862318682d32a",
  "url": "https://discuss.hashicorp.com/t/hcsec-2026-39-go-getter-vulnerable-to-a-privilege-escalation-issue-in-its-archive-decompression-handling/77752",
  "method": "llm",
  "payload": {
    "kind": "patch",
    "title": "HCSEC-2026-39 - Go-getter vulnerable to a privilege escalation issue in its archive decompression handling",
    "summary": "Go-getter archive extraction could apply elevated permission bits from crafted archives, potentially allowing a local actor to obtain the privileges of the extracting process. The issue is fixed in go-getter 1.8.9 and 2.2.4.",
    "evidence": "This vulnerability (CVE-2026-88922) is fixed in go-getter 1.8.9 and 2.2.4.",
    "products": [
      {
        "name": {
          "value": "go-getter",
          "evidence": "The go-getter library up to versions 1.8.8 and 2.2.3"
        },
        "prerequisites": [
          {
            "value": "Where extraction is performed by a privileged user",
            "evidence": "Where extraction is performed by a privileged user, this may allow a local actor to obtain the privileges of the extracting process."
          },
          {
            "value": "a local actor with access to the destination path",
            "evidence": "An archive from an untrusted or attacker influenced source could therefore cause files to be created with elevated permission bits, which a local actor with access to the destination path may be able to use to obtain the privileges of the account that performed the extraction."
          }
        ],
        "fixed_versions": [
          {
            "value": "1.8.9",
            "evidence": "This vulnerability (CVE-2026-88922) is fixed in go-getter 1.8.9 and 2.2.4."
          },
          {
            "value": "2.2.4",
            "evidence": "This vulnerability (CVE-2026-88922) is fixed in go-getter 1.8.9 and 2.2.4."
          }
        ],
        "affected_versions": [
          {
            "value": "up to versions 1.8.8 and 2.2.3",
            "evidence": "The go-getter library up to versions 1.8.8 and 2.2.3"
          }
        ]
      }
    ],
    "severity": "unknown",
    "fixed_cves": [
      {
        "cve": "CVE-2026-88922",
        "product": "go-getter",
        "evidence": "This vulnerability (CVE-2026-88922) is fixed in go-getter 1.8.9 and 2.2.4."
      }
    ],
    "related_cves": [
      {
        "value": "CVE-2026-88922",
        "evidence": "This vulnerability (CVE-2026-88922) is fixed in go-getter 1.8.9 and 2.2.4."
      }
    ],
    "security_relevant": true,
    "severity_evidence": null
  },
  "source_id": "official-hashicorp-discuss-security",
  "document_id": 24005,
  "published_at": "2026-09-15T19:42:55+00:00"
}