HashiCorp's go-getter library up to v1.8.5 is vulnerable to arbitrary file reads on the file system during certain git operations through a maliciously crafted URL (CVE-2026-4660), potentially allowing attackers to access sensitive information.
PoC
Terraform +3
cve-2026-4660
file-read
go-getter
information-disclosure
2r
1t
1c
1i
updated