CVE-2024-6257

Name of the Vulnerable Software and Affected Versions HashiCorp’s go-getter library (affected versions not specified)

Description The issue is related to the go-getter library's handling of Git updates on existing maliciously modified Git configurations, potentially leading to arbitrary code execution. When performing a Git operation, the library clones a given repository to a specified destination, initializing a Git config. An attacker may alter this config after cloning to set an arbitrary Git configuration and achieve code execution. The exploitation of this issue may allow a remote attacker to execute arbitrary code.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.