VDB
CVE-2025-0377
CVE-2025-0377
PUBLISHED
CVSS 7.5 HIGH
HashiCorp’s go-slug library is vulnerable to a zip-slip style attack when a non-existing user-provided path is extracted from the tar entry.
EPSS 0.69% · 52.0th percentile
Risk Scores
CVSS 3.1
7.5
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
EPSS Score
0.69%
52.0th percentile
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| hashicorp | go-slug | 0, 0 |
| HashiCorp | Shared library | 0, 0 |
| github.com | hashicorp/go-slug | 0, 0 |
Timeline
- Jan 21, 2025 CVE Published
- Jan 21, 2025 PoC Published
- Jan 21, 2025 PoC Published
- Jan 21, 2025 PoC Published
- Jan 21, 2025 PoC Published
- Jan 22, 2025 EPSS Score
- Jan 29, 2025 Coalition ESS Score
- Feb 7, 2025 EPSS Score
- Feb 23, 2025 EPSS Score
- Mar 11, 2025 EPSS Score
- Mar 27, 2025 EPSS Score
- Apr 13, 2025 EPSS Score