VDB
CVE-2025-0377
CVE-2025-0377
PUBLISHED
CVSS 7.5 HIGH
HashiCorp’s go-slug library is vulnerable to a zip-slip style attack when a non-existing user-provided path is extracted from the tar entry.
EPSS 0.47% · 64.8th percentile
Risk Scores
CVSS 3.1
7.5
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
EPSS Score
0.47%
64.8th percentile
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| hashicorp | go-slug | 0, 0 |
| HashiCorp | Shared library | 0, 0 |
| github.com | hashicorp/go-slug | 0, 0 |
Exploit Intelligence
- CIRCL seen: CVE-2025-0377 (circl-sighting)
- CIRCL seen: CVE-2025-0377 (circl-sighting)
- CIRCL seen: CVE-2025-0377 (circl-sighting)
- CIRCL seen: CVE-2025-0377 (circl-sighting)
- https://discuss.hashicorp.com/t/hcsec-2025-01-hashicorp-go-slug-vulnerable-to-zip-slip-attack (circl)
Timeline
- Jan 21, 2025 CVE Published
- Jan 21, 2025 PoC Published
- Jan 21, 2025 PoC Published
- Jan 21, 2025 PoC Published
- Jan 21, 2025 PoC Published
- Jan 22, 2025 EPSS Score
- Jan 29, 2025 Coalition ESS Score
- Feb 6, 2025 EPSS Score
- Feb 22, 2025 EPSS Score
- Mar 9, 2025 EPSS Score
- Mar 24, 2025 EPSS Score
- Apr 8, 2025 EPSS Score