CVE-2025-0377
CVSS 3.1 Score 7.5 of 10 (high)
Details
Published Jan 21, 2025
CWE ID 59
Summary
CVE-2025-0377 is a newly disclosed vulnerability affecting HashiCorp's go-slug library. The issue arises when the library processes tar entries with user-provided paths. If the path does not exist, a zip-slip attack can occur, allowing an attacker to potentially access or modify unintended files. This can lead to serious security consequences, such as data breaches or system compromise. It is crucial for users of go-slug to update to the latest version to mitigate this risk.
Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.
Affected Vendors
- HashiCorp Inc.