https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sat, 03 Oct 2026 05:17:47 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-372687 EUVD-2026-372687 https://cve.radiocsirt.org/vuln/euvd-2026-372687 https://cve.radiocsirt.org/vuln/fkie_cve-2026-88922 <p>The go-getter library up to versions 1.8.8 and 2.2.3 is vulnerable to a privilege escalation issue in its archive decompression handling that may allow a crafted archive to cause extracted files to be created with elevated permission bits. Where extraction is performed by a privileged user, this may allow a local actor to obtain the privileges of the extracting process. This vulnerability (CVE-2026-88922) is fixed in go-getter 1.8.9 and 2.2.4.</p> <p>The go-getter library up to versions 1.8.8 and 2.2.3 is vulnerable to a privilege escalation issue in its archive decompression handling that may allow a crafted archive to cause extracted files to be created with elevated permission bits. Where extraction is performed by a privileged user, this may allow a local actor to obtain the privileges of the extracting process. This vulnerability (CVE-2026-88922) is fixed in go-getter 1.8.9 and 2.2.4.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-88922 https://cve.radiocsirt.org/vuln/ghsa-34p9-pr49-jvvc <p>The go-getter library up to versions 1.8.8 and 2.2.3 is vulnerable to a privilege escalation issue in its archive decompression handling that may allow a crafted archive to cause extracted files to be created with elevated permission bits. Where extraction is performed by a privileged user, this may allow a local actor to obtain the privileges of the extracting process. This vulnerability (CVE-2026-88922) is fixed in go-getter 1.8.9 and 2.2.4.</p> <p>The go-getter library up to versions 1.8.8 and 2.2.3 is vulnerable to a privilege escalation issue in its archive decompression handling that may allow a crafted archive to cause extracted files to be created with elevated permission bits. Where extraction is performed by a privileged user, this may allow a local actor to obtain the privileges of the extracting process. This vulnerability (CVE-2026-88922) is fixed in go-getter 1.8.9 and 2.2.4.</p> https://cve.radiocsirt.org/vuln/ghsa-34p9-pr49-jvvc https://cve.radiocsirt.org/vuln/rhsa-2026:68251 <p>github.com/hashicorp/go-getter: Go-getter: Privilege escalation via crafted archive decompression</p> <p>github.com/hashicorp/go-getter: Go-getter: Privilege escalation via crafted archive decompression</p> https://cve.radiocsirt.org/vuln/rhsa-2026:68251