CVE-2026-88922 Go-getter vulnerable to a privilege escalation issue in its archive decompression handling
A crafted archive in go-getter can cause files to be extracted with elevated permissions, allowing local privilege escalation when extracted by a privileged user.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2026-88922?
CVE-2026-88922 is a medium-severity vulnerability in HashiCorp Shared library, published on 15 Sep 2026. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link.
Official description
The go-getter library up to versions 1.8.8 and 2.2.3 is vulnerable to a privilege escalation issue in its archive decompression handling that may allow a crafted archive to cause extracted files to be created with elevated permission bits. Where extraction is performed by a privileged user, this may allow a local actor to obtain the privileges of the extracting process. This vulnerability (CVE-2026-88922) is fixed in go-getter 1.8.9 and 2.2.4.
Weakness: CWE-281
Which versions are affected by CVE-2026-88922?
Linux distribution packages (4)
grype Red Hat:hummingbird:1 | All versions | 0:0.118.0-0.2.hum1 |
opentofu1.10 Red Hat:hummingbird:1 | All versions | 0:1.10.10-0.4.hum1 |
opentofu1.12 Red Hat:hummingbird:1 | All versions | 0:1.12.6-0.2.hum1 |
syft Red Hat:hummingbird:1 | All versions | 0:1.51.1-0.2.hum1 |
How do I fix CVE-2026-88922?
Upgrade to a fixed version.
Is CVE-2026-88922 being exploited?
There is no known exploitation of CVE-2026-88922 in the wild and no public exploit code.
Sources
Also known as AZL-103254, DEBIAN-CVE-2026-88922, GHSA-34p9-pr49-jvvc, RHSA-2026:68251, RHSA-2026:68255, RHSA-2026:68259 and 2 more.