MEDIUMCVSS 6.7
The go-getter library up to versions 1.8.8 and 2.2.3 is vulnerable to a privilege escalation issue in its archive decompression handling that may allow a crafted archive to cause extracted files to be created with elevated permission bits. Where extraction is performed by a privileged user, this may allow a local actor to obtain the privileges of the extracting process. This vulnerability (CVE-2026-88922) is fixed in go-getter 1.8.9 and 2.2.4.
Published 2026-09-15 · last modified 2026-09-15
← Get alerted the moment a CVE hits your gear — subscribe freeNcerio by BeyondNets · data from NVD, CISA KEV, EPSS.