CVE-2025-0377 – github.com/hashicorp/go-slug

Package

Manager: go
Name: github.com/hashicorp/go-slug
Vulnerable Version: >=0 <0.16.3

Severity

Level: High

CVSS v3.1: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

CVSS v4.0: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

EPSS: 0.00054 pctl0.16632

Details

HashiCorp go-slug Vulnerable to Zip Slip Attack ## Summary HashiCorp’s go-slug library is vulnerable to a zip-slip style attack when a non-existing user-provided path is extracted from the tar entry. This vulnerability, identified as CVE-2025-0377, is fixed in go-slug 0.16.3. ## Background HashiCorp’s go-slug shared library offers functions for packing and unpacking Terraform Enterprise compatible slugs. Slugs are gzip compressed tar files containing Terraform configuration files. ## Details When go-slug performs an extraction, the filename/extraction path is taken from the tar entry via the header.Name. It was discovered that the unpacking step improperly validated paths, potentially leading to path traversal, allowing an attacker to write an arbitrary file during extraction. ## Remediation Consumers of the go-slug shared library should evaluate the risk associated with this issue in the context of their go-slug usage and upgrade go-slug to 0.16.3 or later.

Metadata

Created: 2025-01-21T18:31:07Z
Modified: 2025-01-21T20:27:08Z
Source: https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/01/GHSA-wpfp-cm49-9m9q/GHSA-wpfp-cm49-9m9q.json
CWE IDs: ["CWE-59"]
Alternative ID: GHSA-wpfp-cm49-9m9q
Finding: F076
Auto approve: 1