Every CVE Search/ Get API key

CVE-2025-0377

HashiCorp go-slug Vulnerable to Zip Slip Attack

7.5 HighFix available

HashiCorp’s go-slug library is vulnerable to a zip-slip style attack when a non-existing user-provided path is extracted from the tar entry.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
High
Integrity
None
Availability
None

Exploit likelihood

0.68%Up 0.6 points since Jan 22, 2025
90%50%10%1%

What each source reports

CVE List Score used 7.5

HashiCorp go-slug Vulnerable to Zip Slip Attack

HashiCorp’s go-slug library is vulnerable to a zip-slip style attack when a non-existing user-provided path is extracted from the tar entry.

Record
CVE-2025-0377
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Weakness
CWE-59
Updated
2026-11-02
EUVDEUVD-2025-0202 7.5

HashiCorp’s go-slug library is vulnerable to a zip-slip style attack when a non-existing user-provided path is extracted from the tar entry.

Record
EUVD-2025-0202
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Updated
2026-11-03
GitHub AdvisoriesGHSA-wpfp-cm49-9m9q 7.5

HashiCorp go-slug Vulnerable to Zip Slip Attack

Summary

HashiCorp’s go-slug library is vulnerable to a zip-slip style attack when a non-existing user-provided path is extracted from the tar entry. This vulnerability, identified as CVE-2025-0377, is fixed in go-slug 0.16.3.

Background

HashiCorp’s go-slug shared library offers functions for packing and unpacking Terraform Enterprise compatible slugs. Slugs are gzip compressed tar files containing Terraform configuration files.

Details

When go-slug performs an extraction, the filename/extraction path is taken from the tar entry via the header.Name. It was discovered that the unpacking step improperly validated paths, potentially leading to path traversal, allowing an attacker to write an arbitrary file during extraction.

Remediation

Consumers of the go-slug shared library should evaluate the risk associated with this issue in the context of their go-slug usage and upgrade go-slug to 0.16.3 or later.

Record
GHSA-wpfp-cm49-9m9q
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Weakness
CWE-59
Updated
2026-11-02
NVD 7.5

HashiCorp’s go-slug library is vulnerable to a zip-slip style attack when a non-existing user-provided path is extracted from the tar entry.

Record
CVE-2025-0377
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CVSS 3.1
9.1 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Weakness
CWE-59
Updated
2026-11-02
OSV 7.5

HashiCorp go-slug Vulnerable to Zip Slip Attack

HashiCorp’s go-slug library is vulnerable to a zip-slip style attack when a non-existing user-provided path is extracted from the tar entry.

Record
CVE-2025-0377
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Weakness
CWE-59
Updated
2026-11-02
OSVGHSA-wpfp-cm49-9m9q 7.5

HashiCorp go-slug Vulnerable to Zip Slip Attack

Summary

HashiCorp’s go-slug library is vulnerable to a zip-slip style attack when a non-existing user-provided path is extracted from the tar entry. This vulnerability, identified as CVE-2025-0377, is fixed in go-slug 0.16.3.

Background

HashiCorp’s go-slug shared library offers functions for packing and unpacking Terraform Enterprise compatible slugs. Slugs are gzip compressed tar files containing Terraform configuration files.

Details

When go-slug performs an extraction, the filename/extraction path is taken from the tar entry via the header.Name. It was discovered that the unpacking step improperly validated paths, potentially leading to path traversal, allowing an attacker to write an arbitrary file during extraction.

Remediation

Consumers of the go-slug shared library should evaluate the risk associated with this issue in the context of their go-slug usage and upgrade go-slug to 0.16.3 or later.

Record
GHSA-wpfp-cm49-9m9q
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Weakness
CWE-59
Updated
2026-11-02
Show 6 moreShow less
OSVROOT-APP-GOBINARY-CVE-2025-0377 7.5

CVE-2025-0377 in github.com/hashicorp/go-slug - Patched by Root

Root has patched CVE-2025-0377 in the github.com/hashicorp/go-slug package for Root:Go. Multiple fixed versions available.

Record
ROOT-APP-GOBINARY-CVE-2025-0377
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Updated
2026-11-02
OSVGO-2025-3413 No score

HashiCorp go-slug Vulnerable to Zip Slip Attack in github.com/hashicorp/go-slug

HashiCorp go-slug Vulnerable to Zip Slip Attack in github.com/hashicorp/go-slug

Record
GO-2025-3413
Updated
2026-11-02
OSVopenSUSE-SU-2025:14684-1 No score

helmfile-0.170.1-1.1 on GA media

These are all security issues fixed in the helmfile-0.170.1-1.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2025:14684-1
Updated
2026-11-02
OSVopenSUSE-SU-2025:14710-1 No score

govulncheck-vulndb-0.0.20250128T150132-1.1 on GA media

These are all security issues fixed in the govulncheck-vulndb-0.0.20250128T150132-1.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2025:14710-1
Updated
2026-11-02
OSVopenSUSE-SU-2025:20097-1 No score

Security update for helmfile

This update for helmfile fixes the following issues:

Changes in helmfile:

Update to version 1.1.9:

  • feat: update strategy for reinstall by @simbou2000 in #2019
  • build(deps): bump github.com/aws/aws-sdk-go-v2/service/s3 from 1.88.7 to 1.89.0 by @dependabot[bot] in #2239
  • Fix: Handle empty helmBinary in base files with environment values by @Copilot in #2237

Update to version 1.1.8:

  • build(deps): bump github.com/hashicorp/go-getter from 1.8.0 to 1.8.1 by @dependabot[bot] in #2194
  • fix typos in both comment and error message by @d-fal in #2199
  • cleanup disk in release ci by @yxxhero in #2203
  • Migrate AWS SDK from v1 to v2 to resolve deprecation warnings by @Copilot in #2202
  • build(deps): bump github.com/helmfile/vals from 0.42.1 to 0.42.2 by @dependabot[bot] in #2200
  • build(deps): bump github.com/aws/aws-sdk-go-v2/service/s3 from 1.88.2 to 1.88.3 by @dependabot[bot] in #2206
  • Bump Alpine to 3.22 in Dockerfile by @orishamir in #2205
  • build(deps): bump github.com/aws/aws-sdk-go-v2/config from 1.31.10 to 1.31.12 by @dependabot[bot] in #2207
  • Add yq to Dockerfile by @orishamir in #2208
  • fix: skip chartify for build command jsonPatches by @sstarcher in #2212
  • build(deps): bump github.com/hashicorp/go-getter from 1.8.1 to 1.8.2 by @dependabot[bot] in #2210
  • build(deps): bump github.com/aws/aws-sdk-go-v2/service/s3 from 1.88.3 to 1.88.4 by @dependabot[bot] in #2213
  • build(deps): bump golang.org/x/term from 0.35.0 to 0.36.0 by @dependabot[bot] in #2214
  • Avoid fetching same chart/version multiple times by @Copilot in #2197
  • build(deps): bump github.com/helmfile/vals from 0.42.2 to 0.42.4 by @dependabot[bot] in #2217
  • docs: add zread badge to README by @yxxhero in #2219
  • Bump helm-diff to v3.13.1 by @Copilot in #2223
  • build(deps): bump github.com/aws/aws-sdk-go-v2/service/s3 from 1.88.4 to 1.88.5 by @dependabot[bot] in #2226
  • build(deps): bump github.com/aws/aws-sdk-go-v2/config from 1.31.12 to 1.31.13 by @dependabot[bot] in #2225
  • build(deps): bump github.com/aws/aws-sdk-go-v2/service/s3 from 1.88.5 to 1.88.6 by @dependabot[bot] in #2230
  • build(deps): bump github.com/aws/aws-sdk-go-v2/service/s3 from 1.88.6 to 1.88.7 by @dependabot[bot] in #2232
  • build(deps): bump github.com/aws/aws-sdk-go-v2/config from 1.31.13 to 1.31.15 by @dependabot[bot] in #2233
  • Fix helmBinary and kustomizeBinary being ignored when using bases by @Copilot in #2228

Update to version 1.1.7:

What's Changed

  • fix pflag error by @zhaque44 in #2164
  • build(deps): bump actions/setup-go from 5 to 6 by @dependabot[bot] in #2166
  • build(deps): bump github.com/hashicorp/go-getter from 1.7.9 to 1.7.10 by @dependabot[bot] in #2165
  • build(deps): bump github.com/spf13/pflag from 1.0.9 to 1.0.10 by @dependabot[bot] in #2163
  • Add helm diff installation to README by @nwneisen in #2170
  • build(deps): bump github.com/hashicorp/go-getter from 1.7.10 to 1.8.0 by @dependabot[bot] in #2175
  • build(deps): bump golang.org/x/term from 0.34.0 to 0.35.0 by @dependabot[bot] in #2174
  • build(deps): bump github.com/zclconf/go-cty from 1.16.4 to 1.17.0 by @dependabot[bot] in #2173
  • Fix panic when helm isn't installed by @nwneisen in #2169
  • build(deps): bump golang.org/x/sync from 0.16.0 to 0.17.0 by @dependabot[bot] in #2172
  • ci: update minikube and kubernetes versions by @yxxhero in #2181
  • build(deps): bump k8s.io/apimachinery from 0.34.0 to 0.34.1 by @dependabot[bot] in #2180
  • Remove deprecated --wait-retries flag support to fix Helm compatibility error by @Copilot in #2179
  • build(deps): bump go.yaml.in/yaml/v2 from 2.4.2 to 2.4.3 by @dependabot[bot] in #2183
  • build: update Helm to v3.19.0 across all components by @yxxhero in #2187
  • build: update helm-diff plugin to v3.13.0 by @yxxhero in #2189
  • feat: Implement caching for pulling OCI charts by…
Record
openSUSE-SU-2025:20097-1
Updated
2026-11-02
OSVSUSE-SU-2025:0297-1 No score

Security update for govulncheck-vulndb

This update for govulncheck-vulndb fixes the following issues:

  • Update to version 0.0.20250128T150132 2025-01-28T15:01:32Z. Refs jsc#PED-11136 Go CVE Numbering Authority IDs added or updated with aliases:

    • GO-2025-3409 CVE-2025-23208 GHSA-c9p4-xwr9-rfhx
    • GO-2025-3410 CVE-2025-24337 GHSA-3qc3-mx6x-267h
    • GO-2025-3413 CVE-2025-0377 GHSA-wpfp-cm49-9m9q
    • GO-2025-3414 CVE-2024-11218 GHSA-5vpc-35f4-r8w6
    • GO-2025-3415 CVE-2025-23028 GHSA-9m5p-c77c-f9j7
    • GO-2025-3416 CVE-2025-23047 GHSA-h78m-j95m-5356
    • GO-2025-3418 CVE-2025-24030 GHSA-j777-63hf-hx76
    • GO-2025-3419 CVE-2025-24355 GHSA-v34r-vj4r-38j6
    • GO-2025-3422 CVE-2025-24354

  • Update to version 0.0.20250128T004730 2025-01-28T00:47:30Z. Refs jsc#PED-11136 Go CVE Numbering Authority IDs added or updated with aliases:

    • GO-2025-3372 CVE-2024-45339
    • GO-2025-3373 CVE-2024-45341
    • GO-2025-3383 CVE-2024-45340
    • GO-2025-3420 CVE-2024-45336
    • GO-2025-3421 CVE-2025-22865

  • Update to version 0.0.20250117T214834 2025-01-17T21:48:34Z. Refs jsc#PED-11136 Go CVE Numbering Authority IDs added or updated with aliases:

    • GO-2025-3392 CVE-2025-20086 GHSA-5m7j-6gc4-ff5g
    • GO-2025-3393 CVE-2025-21088 GHSA-8j3q-gc9x-7972
    • GO-2025-3394 CVE-2025-20088 GHSA-45v9-w9fh-33j6
    • GO-2025-3396 CVE-2024-52594
    • GO-2025-3397 CVE-2024-36402 GHSA-8vmr-h7h5-cqhg
    • GO-2025-3398 CVE-2024-52791 GHSA-gp86-q8hg-fpxj
    • GO-2025-3399 CVE-2024-52602 GHSA-r6jg-jfv6-2fjv
    • GO-2025-3400 CVE-2024-56515 GHSA-rcxc-wjgw-579r
    • GO-2025-3401 CVE-2024-36403 GHSA-vc2m-hw89-qjxf
    • GO-2025-3407 CVE-2025-20621 GHSA-w6xh-c82w-h997

  • Update to version 0.0.20250115T172141 2025-01-15T17:21:41Z. Refs jsc#PED-11136 Go CVE Numbering Authority IDs added or updated with aliases:

    • GO-2025-3381 CVE-2024-56138 GHSA-45v3-38pc-874v
    • GO-2025-3382 CVE-2024-51491 GHSA-qjh3-4j3h-vmwp
    • GO-2025-3384 CVE-2024-56323 GHSA-32q6-rr98-cjqv
    • GO-2025-3390 CVE-2024-53263 GHSA-q6r2-x2cc-vrp7
    • GO-2025-3391 CVE-2024-52281 GHSA-2v2w-8v8c-wcm9

  • Update to version 0.0.20250109T194159 2025-01-09T19:41:59Z. Refs jsc#PED-11136 Go CVE Numbering Authority IDs added or updated with aliases:

    • GO-2025-3376 CVE-2025-22149 GHSA-675f-rq2r-jw82
    • GO-2025-3377 CVE-2025-22449 GHSA-q8fg-cp3q-5jwm
    • GO-2025-3379 CVE-2025-20033 GHSA-2549-xh72-qrpm
    • GO-2025-3380 CVE-2025-22445 GHSA-7rgp-4j56-fm79
Record
SUSE-SU-2025:0297-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
github.com/hashicorp/go-slug
Go
 before 0.16.3
0.16.3
github.com/hashicorp/go-slug
Root:Go
 before v0.15.0-aikido.1
v0.15.0-aikido.1
rootio-github.com/hashicorp/go-slug
Root:Go
 before v0.15.0-root.io.1
v0.15.0-root.io.1
govulncheck-vulndb
SUSE:Linux Enterprise Module for Package Hub 15 SP6
From an advisory covering 33 CVEs
 before 0.0.20250128T150132-150000.1.29.1
0.0.20250128T150132-150000.1.29.1
govulncheck-vulndb
openSUSE:Leap 15.6
From an advisory covering 33 CVEs
 before 0.0.20250128T150132-150000.1.29.1
0.0.20250128T150132-150000.1.29.1
helmfile
openSUSE:Tumbleweed
 before 0.170.1-1.1
0.170.1-1.1
govulncheck-vulndb
openSUSE:Tumbleweed
From an advisory covering 14 CVEs
 before 0.0.20250128T150132-1.1
0.0.20250128T150132-1.1
helmfile
openSUSE:Leap 16.0
From an advisory covering 2 CVEs
 before 1.1.9-bp160.1.1
1.1.9-bp160.1.1

History

History
RecordedChangedSources
affected, facts
aliases, publishedEUVD
first indexedCVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2025-0377 is a high vulnerability (CVSS 7.5) in Hashicorp Go-slug, published January 21, 2025. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.68%, the 52nd percentile. Fixed in github.com/hashicorp/go-slug 0.16.3.

References

Show 34 moreShow less
This page doesn't list everything

Left out here: the rest of 1 source description. The JSON record has them.

Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open