Detections
Analytics
CVE-2025-0377
critical
Description
HashiCorp’s go-slug library is vulnerable to a zip-slip style attack when a non-existing user-provided path is extracted from the tar entry.
References
https://euvd.enisa.europa.eu/vulnerability/EUVD-2025-0202
https://discuss.hashicorp.com/t/hcsec-2025-01-hashicorp-go-slug-vulnerable-to-zip-slip-attack
Details
Published: 2025-01-21
Updated: 2025-12-15
Named Vulnerability: GO-2025-3413Named Vulnerability: GHSA-wpfp-cm49-9m9q
Risk Information
CVSS v2
Base Score: 9.4
Vector: CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:N
Severity: High
CVSS v3
Base Score: 9.1
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Severity: Critical
EPSS
EPSS: 0.00069