The flaw in HashiCorp’s go‑getter library allows an attacker to read any file on the host operating system during certain Git operations. By supplying a maliciously crafted Git URL, a remote code execution vector is created that falls under CWE‑200, enabling confidential data disclosure such as credentials, configuration files, or private keys.

The vulnerability exists in all releases of HashiCorp's go‑getter up to and including v1.8.5. The library is commonly used across HashiCorp tooling, while the separate go‑getter/v2 branch is unaffected. The issue is resolved in go‑getter v1.8.6 and later.

With a CVSS score of 7.5 the flaw is classified as high severity, indicating serious risk if exploited. No EPSS data is available and the vulnerability is not listed in the CISA KEV catalog, so the exact exploit likelihood is unknown. However, the attack path—injecting a malicious Git URL during normal repository operations—is easily achievable in any environment that uses go‑getter for remote fetching, making the risk considerable for exposed pieces of the code base or configuration.