Unsafe tar unpacking in HashiCorp go-slug

HIGH 7.5CVE-2020-29529 · GHSA-2g5j-5x95-r6hr · GO-2021-0094 · Published 03/12/2020 · updated 17/06/2026

In short

CVE-2020-29529 is a HIGH (CVSS 7.5) vulnerability affecting github.com/hashicorp/go-slug, go-slug (hashicorp).
Chance of exploitation in the next 30 days (EPSS): 2.8%, higher than 86.6% of all vulnerabilities.
Fix: update to 0.5.0 or later.

Package	Affected versions	Patched versions
github.com/hashicorp/go-slug Go	`< 0.5.0`	`0.5.0`
go-slug hashicorp	`< 0.5.0`	`0.5.0`

Description

HashiCorp go-slug before 0.5.0 does not address attempts at directory traversal involving ../ and symlinks.

NVD description

HashiCorp go-slug up to 0.4.3 did not fully protect against directory traversal while unpacking tar archives, and protections could be bypassed with specific constructions of multiple symlinks. Fixed in 0.5.0.

References

nvd.nist.gov/vuln/detail/CVE-2020-29529 · ADVISORY
hashicorp/go-slug#12 · WEB
hashicorp/go-slug commit 28cafc5 · WEB
hashicorp/go-slug commit 764785b · WEB
hashicorp/go-slug · PACKAGE
hashicorp/go-slug · WEB
hashicorp/go-slug release v0.5.0 · WEB
pkg.go.dev/vuln/GO-2021-0094 · WEB
securitylab.github.com/advisories/GHSL-2020-262-zipslip-go-slug · ADVISORY

More vulnerabilities in github.com/hashicorp/go-slug

See all →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free