An open index of dependabot pull requests across open source projects.

github.com/hashicorp/go-getter

Ecosystem:
go
Package URL:
pkg:golang/github.com/hashicorp/go-getter
Total PRs:
1,098 Dependabot PRs
Latest PR:
12 days ago
Unique Repositories:
542 repositories
Unique Repos (30 days):
86 repositories
Security Advisories
HashiCorp go-getter Vulnerable to Symlink Attacks
GHSA-wjrx-6529-hcj3 CVE-2025-8959 HIGH published 3 months ago • updated 3 months ago
HashiCorp's go-getter library subdirectory download feature is vulnerable to symlink attacks leading to unauthorized read access beyond the designa...
HashiCorp go-getter Vulnerable to Code Execution On Git Update Via Git Config Manipulation
GHSA-xfhp-jf8p-mh5w CVE-2024-6257 HIGH published over 1 year ago • updated 3 months ago
HashiCorp’s go-getter library can be coerced into executing Git update on an existing maliciously modified Git Configuration, potentially leading t...
Insertion of Sensitive Information into Log File in Hashicorp go-getter
GHSA-27rq-4943-qcwp CVE-2022-29810 MODERATE published over 3 years ago • updated 3 months ago
The Hashicorp go-getter library before 1.5.11 could write SSH credentials into its logfile, exposing sensitive credentials to local users able to r...
Data Amplification in HashiCorp go-getter
GHSA-jpxj-2jvg-6jv9 CVE-2023-0475 MODERATE published over 2 years ago • updated 4 months ago
HashiCorp go-getter up to 1.6.2 and 2.1.1 is vulnerable to decompression bombs. Fixed in 1.7.0 and 2.2.0.
HashiCorp go-getter unsafe downloads could lead to asymmetric resource exhaustion
GHSA-28r2-q6m8-9hpx CVE-2022-30323 HIGH published over 3 years ago • updated 3 months ago
HashiCorp go-getter through 2.0.2 does not safely perform downloads. Asymmetric resource exhaustion could occur when go-getter processed malicious ...
Recent PRs
Package Details
Name: github.com/hashicorp/go-getter
Ecosystem: go
PURL Type: golang
Package URL: pkg:golang/github.com/hashicorp/go-getter
JSON API: View JSON
Security Advisories

9

Active advisories
CRITICAL 2
HIGH 5
MODERATE 2
View All golang Advisories
Package Information
Description:

getter is a package for downloading files or directories from a variety of protocols. getter is unique in its ability to download both directories and files. It also detects certain source strings to be protocol-specific URLs. For example, "github.com/hashicorp/go-getter" would turn into a Git URL and use the Git protocol. Protocols and detectors are extensible. To get started, see Client.

Repository: https://github.com/hashicorp/go-getter
Homepage: https://github.com/hashicorp/go-getter
Latest Release: v1.7.8
10 months ago
Dependent Repos: 6,872
Dependent Packages: 3,705
Ranking: Top 0.0949% by dependent repos Top 0.0592% by dependent pkgs
PR Status
Open 659 (60.0%)
Merged 109 (9.9%)
Closed 313 (28.5%)
PR Types
Minor 379 (34.5%)
Patch 702 (63.9%)