7.4 High
AI Score
Confidence
High
0.002 Low
EPSS
Percentile
56.5%
HashiCorp go-slug up to 0.4.3 did not fully protect against directory traversal while unpacking tar archives, and protections could be bypassed with specific constructions of multiple symlinks. Fixed in 0.5.0.
github.com/hashicorp/go-slug/compare/v0.4.3...v0.5.0
github.com/hashicorp/go-slug/pull/12
github.com/hashicorp/go-slug/releases/tag/v0.5.0
securitylab.github.com/advisories/GHSL-2020-262-zipslip-go-slug