GO-2026-4278
- Source
- https://pkg.go.dev/vuln/GO-2026-4278
- Import Source
- https://vuln.go.dev/ID/GO-2026-4278.json
- JSON Data
- https://api.osv.dev/v1/vulns/GO-2026-4278
- Aliases
- Published
- 2026-01-12T17:39:39Z
- Modified
- 2026-01-12T18:10:57.829088Z
- Summary
- HashiCorp Nomad is vulnerable to path escape through archive unpacking during migration in github.com/hashicorp/nomad
- Details
-
HashiCorp Nomad is vulnerable to path escape through archive unpacking during migration in github.com/hashicorp/nomad
- Database specific
{ "review_status": "UNREVIEWED", "url": "https://pkg.go.dev/vuln/GO-2026-4278" }- References
-
- https://github.com/advisories/GHSA-5mqx-rpxv-mvxj
- https://nvd.nist.gov/vuln/detail/CVE-2024-6717
- https://github.com/hashicorp/nomad/pull/27068/commits/d0f4f27dd03e7f9843d7b921ca9f33c257efdfd1
- https://discuss.hashicorp.com/t/hcsec-2024-15-nomad-vulnerable-to-allocation-directory-path-escape-through-archive-unpacking/68781
- https://github.com/hashicorp/nomad/releases/tag/v1.11.1
Affected packages
Go / github.com/hashicorp/nomad
Package
- Name
- github.com/hashicorp/nomad
- View open source insights on deps.dev
- Purl
- pkg:golang/github.com/hashicorp/nomad