HashiCorp's go-getter library versions up to 1.8.5 contain a vulnerability (CVE-2026-4660) that permits unauthorized arbitrary file reads on the local file system when processing certain git operations involving maliciously crafted URLs. This vulnerability exposes sensitive information to unauthorized actors, categorized as CWE-200. The vulnerability has a CVSS 3.1 base score of 7.5, indicating high severity, with network attack vector, low attack complexity, no privileges or user interaction required, and impacts confidentiality only. The issue is resolved in go-getter v1.8.6, and the go-getter/v2 branch is unaffected.

An attacker can exploit this vulnerability to read arbitrary files on the file system without authentication or user interaction, potentially exposing sensitive information. The impact is limited to confidentiality, with no integrity or availability effects reported. There are no known active exploits in the wild.

Upgrade to go-getter version 1.8.6 or later to remediate this vulnerability. The go-getter/v2 branch is not affected and can be used as an alternative. Since this is a client-side library, users should ensure they are not using vulnerable versions in their tooling. Patch status is confirmed by the vendor advisory stating the fix is included in v1.8.6.