GO-2026-5571
- Source
- https://pkg.go.dev/vuln/GO-2026-5571
- Import Source
- https://vuln.go.dev/ID/GO-2026-5571.json
- JSON Data
- https://api.osv.dev/v1/vulns/GO-2026-5571
- Aliases
- Downstream
- Published
- 2026-06-25T22:34:34Z
- Modified
- 2026-06-25T23:01:23Z
- Summary
- OpenTofu: Possible arbitrary file read during certain git operations via a maliciously crafted URL in github.com/opentofu/opentofu
- Details
-
OpenTofu: Possible arbitrary file read during certain git operations via a maliciously crafted URL in github.com/opentofu/opentofu
- Database specific
{ "review_status": "UNREVIEWED", "url": "https://pkg.go.dev/vuln/GO-2026-5571" }- References
-
- https://github.com/opentofu/opentofu/security/advisories/GHSA-q7j3-v8qv-22vq
- https://github.com/opentofu/opentofu/pull/4288
- https://github.com/opentofu/opentofu/pull/4292
- https://github.com/opentofu/opentofu/pull/4293
- https://github.com/advisories/GHSA-92mm-2pjq-r785
- https://github.com/hashicorp/go-getter/releases/tag/v1.8.6
- https://github.com/opentofu/opentofu/releases/tag/v1.11.10
- https://github.com/opentofu/opentofu/releases/tag/v1.12.3
Affected packages
Go / github.com/opentofu/opentofu
Package
- Name
- github.com/opentofu/opentofu
- View open source insights on deps.dev
- Purl
- pkg:golang/github.com/opentofu/opentofu