StackRadar

CVE-2024-6257

High

Advisory

Published 25 Jun 2024In the index since 5 Sept 2026
Severity
High
worst across findings
CVSS
8.4
base score, highest
EPSS
0.010
60th percentile
CISA KEV
Not listed
no confirmed exploitation
Charts affected
38
of 17,781 indexed, latest versions
Container images
37
deployed by those charts
Fix available
1 of 1
affected package

HashiCorp go-getter Vulnerable to Code Execution On Git Update Via Git Config Manipulation

Carried by container images the latest versions of 38 of 17,781 indexed charts deploy, on 37 images.

Affected packageAffected versionsFixed inImages
github.com/hashicorp/go-gettergolangv1.4.0, v1.4.1, v1.5.1, v1.5.2+9 more1.7.537
OSV records
GHSA-xfhp-jf8p-mh5w
Also known as
GO-2024-2948

Charts affected

38 by stars
ChartLatestAffected imagesRadar Score
atlantisatlantis6.15.01 of 1See more

atlantis atlantis 6.15.0

1 of the 1 container images this version deploys carry CVE-2024-6257.

Container imageDigestPackageFixed in
ghcr.io/runatlantis/atlantis:v0.47.1511231955463
github.com/hashicorp/go-getter@v1.7.4
1.7.5

Open the chart page →

1,891
waypointhashicorpVerified publisher0.1.211 of 2See more

waypoint hashicorp 0.1.21

1 of the 2 container images this version deploys carry CVE-2024-6257.

Container imageDigestPackageFixed in
hashicorp/waypoint:0.11.397d521a27498
github.com/hashicorp/go-getter@v1.7.0
1.7.5

Open the chart page →

4,167
celestia-appcelestia-labsVerified publisher0.5.01 of 3See more

celestia-app celestia-labs 0.5.0

1 of the 3 container images this version deploys carry CVE-2024-6257.

Container imageDigestPackageFixed in
ghcr.io/celestiaorg/celestia-app:v3.7.0-arabica23a9ec9b1879
github.com/hashicorp/go-getter@v1.7.4
1.7.5

Open the chart page →

1,066
helm-dashboardbeluga-cloudVerified publisher2.4.01 of 1See more

helm-dashboard beluga-cloud 2.4.0

1 of the 1 container images this version deploys carry CVE-2024-6257.

Container imageDigestPackageFixed in
ghcr.io/beluga-cloud/helm-dashboard/dashboard:1.3.39ab9a675c405
github.com/hashicorp/go-getter@v1.7.2
1.7.5

Open the chart page →

2,898
trivy-operatordevopstalesVerified publisher2.5.01 of 1See more

trivy-operator devopstales 2.5.0

1 of the 1 container images this version deploys carry CVE-2024-6257.

Container imageDigestPackageFixed in
devopstales/trivy-operator:2.575136aa7a26e
github.com/hashicorp/go-getter@v1.6.2
1.7.5

Open the chart page →

5,598
artifact-hubsoftonic1.19.02 of 8See more

artifact-hub softonic 1.19.0

2 of the 8 container images this version deploys carry CVE-2024-6257.

Container imageDigestPackageFixed in
aquasec/trivy:0.43.1944a04445179
github.com/hashicorp/go-getter@v1.7.1
1.7.5
artifacthub/scanner:v1.19.0323d026e78c3
github.com/hashicorp/go-getter@v1.7.3
1.7.5

Open the chart page →

14,491
atlantistrozz3.12.111 of 1See more

atlantis trozz 3.12.11

1 of the 1 container images this version deploys carry CVE-2024-6257.

Container imageDigestPackageFixed in
runatlantis/atlantis:v0.16.145fbaf7e207c
github.com/hashicorp/go-getter@v1.5.1
1.7.5

Open the chart page →

5,280
kubedb-provider-awsappscodeVerified publisher2026.7.101 of 1See more

kubedb-provider-aws appscode 2026.7.10

1 of the 1 container images this version deploys carry CVE-2024-6257.

Container imageDigestPackageFixed in
ghcr.io/kubedb/provider-aws:v0.27.049b1c312e342
github.com/hashicorp/go-getter@v1.7.0
1.7.5

Open the chart page →

2,527
kubedb-provider-azureappscodeVerified publisher2026.7.101 of 1See more

kubedb-provider-azure appscode 2026.7.10

1 of the 1 container images this version deploys carry CVE-2024-6257.

Container imageDigestPackageFixed in
ghcr.io/kubedb/provider-azure:v0.27.0aa0c8526ae5e
github.com/hashicorp/go-getter@v1.6.2
1.7.5

Open the chart page →

2,705
kubedb-provider-gcpappscodeVerified publisher2026.7.101 of 2See more

kubedb-provider-gcp appscode 2026.7.10

1 of the 2 container images this version deploys carry CVE-2024-6257.

Container imageDigestPackageFixed in
ghcr.io/kubedb/provider-gcp:v0.27.0a1d4cf8b8fe1
github.com/hashicorp/go-getter@v1.6.2
1.7.5

Open the chart page →

3,033
kubeform-provider-awsappscodeVerified publisher2023.11.11 of 1See more

kubeform-provider-aws appscode 2023.11.1

1 of the 1 container images this version deploys carry CVE-2024-6257.

Container imageDigestPackageFixed in
ghcr.io/kubeform/provider-aws:v0.0.1e3d1f1302e49
github.com/hashicorp/go-getter@v1.6.2
1.7.5

Open the chart page →

2,796
kubeform-provider-azureappscodeVerified publisher2023.11.11 of 1See more

kubeform-provider-azure appscode 2023.11.1

1 of the 1 container images this version deploys carry CVE-2024-6257.

Container imageDigestPackageFixed in
ghcr.io/kubeform/provider-azure:v0.0.1ac8459f70f85
github.com/hashicorp/go-getter@v1.6.2
1.7.5

Open the chart page →

2,716
kubeform-provider-gcpappscodeVerified publisher2023.11.11 of 1See more

kubeform-provider-gcp appscode 2023.11.1

1 of the 1 container images this version deploys carry CVE-2024-6257.

Container imageDigestPackageFixed in
ghcr.io/kubeform/provider-gcp:v0.0.1af77073c184f
github.com/hashicorp/go-getter@v1.6.2
1.7.5

Open the chart page →

2,743
harbor-scanner-trivyaqua-helm0.17.01 of 1See more

harbor-scanner-trivy aqua-helm 0.17.0

1 of the 1 container images this version deploys carry CVE-2024-6257.

Container imageDigestPackageFixed in
aquasec/harbor-scanner-trivy:0.20.07ea4aa3d2eb6
github.com/hashicorp/go-getter@v1.5.2
1.7.5

Open the chart page →

5,202
botkubeaveshaVerified publisher1.0.01 of 2See more

botkube avesha 1.0.0

1 of the 2 container images this version deploys carry CVE-2024-6257.

Container imageDigestPackageFixed in
ghcr.io/kubeshop/botkube:v1.0.0669e27a5d1af
github.com/hashicorp/go-getter@v1.7.0
1.7.5

Open the chart page →

5,074
terraboardcamptocamp32.4.01 of 1See more

terraboard camptocamp3 2.4.0

1 of the 1 container images this version deploys carry CVE-2024-6257.

Container imageDigestPackageFixed in
ghcr.io/camptocamp/terraboard:v2.3.0df53e2c8998c
github.com/hashicorp/go-getter@v1.7.3
1.7.5

Open the chart page →

1,330
ibm-toolkit-installcloud-native-toolkit0.3.01 of 1See more

ibm-toolkit-install cloud-native-toolkit 0.3.0

1 of the 1 container images this version deploys carry CVE-2024-6257.

Container imageDigestPackageFixed in
quay.io/ibmgaragecloud/cli-tools:v0.159663f06adcb1
github.com/hashicorp/go-getter@v1.5.2
1.7.5

Open the chart page →

6,695
iteration-zerocloud-native-toolkit0.2.01 of 1See more

iteration-zero cloud-native-toolkit 0.2.0

1 of the 1 container images this version deploys carry CVE-2024-6257.

Container imageDigestPackageFixed in
quay.io/cloudnativetoolkit/cli-tools:v1.1-v1.8.2d6fd2a9e3273
github.com/hashicorp/go-getter@v1.5.7
1.7.5

Open the chart page →

6,921
devtron-enterprisedevtron48.0.01 of 28See more

devtron-enterprise devtron 48.0.0

1 of the 28 container images this version deploys carry CVE-2024-6257.

Container imageDigestPackageFixed in
quay.io/devtron/image-scanner:94237c18-109-3942098580969b333
github.com/hashicorp/go-getter@v1.7.2
1.7.5

Open the chart page →

68,240
devtron-enterprisedevtron-labs48.0.01 of 28See more

devtron-enterprise devtron-labs 48.0.0

1 of the 28 container images this version deploys carry CVE-2024-6257.

Container imageDigestPackageFixed in
quay.io/devtron/image-scanner:94237c18-109-3942098580969b333
github.com/hashicorp/go-getter@v1.7.2
1.7.5

Open the chart page →

68,240
fickyhelmappfickyhelmapp1.1.01 of 1See more

fickyhelmapp fickyhelmapp 1.1.0

1 of the 1 container images this version deploys carry CVE-2024-6257.

Container imageDigestPackageFixed in
tundeficky/nodejs-app:v1.0.03cf9a9ce54e8
github.com/hashicorp/go-getter@v1.5.4
1.7.5

Open the chart page →

3,311
apm-hubflanksourceVerified publisher0.0.471 of 2See more

apm-hub flanksource 0.0.47

1 of the 2 container images this version deploys carry CVE-2024-6257.

Container imageDigestPackageFixed in
flanksource/apm-hub:v0.0.471dacc3195bf9
github.com/hashicorp/go-getter@v1.7.1
1.7.5

Open the chart page →

6,078
jx-app-datadogjenkins-x0.0.101 of 2See more

jx-app-datadog jenkins-x 0.0.10

1 of the 2 container images this version deploys carry CVE-2024-6257.

Container imageDigestPackageFixed in
datadog/agent:6aad9994de6a7
github.com/hashicorp/go-getter@v1.7.4
1.7.5

Open the chart page →

3,999
pipecdkrzwiatrzyk0.39.01 of 3See more

pipecd krzwiatrzyk 0.39.0

1 of the 3 container images this version deploys carry CVE-2024-6257.

Container imageDigestPackageFixed in
ghcr.io/pipe-cd/pipecd:v0.39.00fae829caf29
github.com/hashicorp/go-getter@v1.4.0
1.7.5

Open the chart page →

3,812
kubeclaritykubeclarity2.23.31 of 5See more

kubeclarity kubeclarity 2.23.3

1 of the 5 container images this version deploys carry CVE-2024-6257.

Container imageDigestPackageFixed in
ghcr.io/openclarity/grype-server:v0.6.079412399f301
github.com/hashicorp/go-getter@v1.7.2
1.7.5

Open the chart page →

5,496
harborkubesphereVerified publisher1.9.31 of 11See more

harbor kubesphere 1.9.3

1 of the 11 container images this version deploys carry CVE-2024-6257.

Container imageDigestPackageFixed in
goharbor/trivy-adapter-photon:v2.5.3b9522c3f5056
github.com/hashicorp/go-getter@v1.6.2
1.7.5

Open the chart page →

17,798
trivy-serverlemontechVerified publisher0.1.01 of 1See more

trivy-server lemontech 0.1.0

1 of the 1 container images this version deploys carry CVE-2024-6257.

Container imageDigestPackageFixed in
aquasec/trivy:0.32.0973d0df16189
github.com/hashicorp/go-getter@v1.6.2
1.7.5

Open the chart page →

4,271
m9sweeperm9sweeperVerified publisher1.6.01 of 6See more

m9sweeper m9sweeper 1.6.0

1 of the 6 container images this version deploys carry CVE-2024-6257.

Container imageDigestPackageFixed in
ghcr.io/m9sweeper/trawler:1.6.0df917c5a7e54
github.com/hashicorp/go-getter@v1.7.2
1.7.5

Open the chart page →

9,774
myhelmappmyhelmapp0.1.11 of 1See more

myhelmapp myhelmapp 0.1.1

1 of the 1 container images this version deploys carry CVE-2024-6257.

Container imageDigestPackageFixed in
tobirachel/node-project3:v17d9f37154994
github.com/hashicorp/go-getter@v1.5.4
1.7.5

Open the chart page →

3,359
anchore-engineopencloudcx1.13.01 of 2See more

anchore-engine opencloudcx 1.13.0

1 of the 2 container images this version deploys carry CVE-2024-6257.

Container imageDigestPackageFixed in
anchore/anchore-engine:v0.10.0bde9eedf639d
github.com/hashicorp/go-getter@v1.4.1
1.7.5

Open the chart page →

18,023
redhat-trusted-application-pipelineopenshift1.0.21 of 2See more

redhat-trusted-application-pipeline openshift 1.0.2

1 of the 2 container images this version deploys carry CVE-2024-6257.

Container imageDigestPackageFixed in
quay.io/redhat-appstudio/appstudio-utils:dbbdd82734232e6289e8fbae5b4c858481a7c0577b4202c25b67
github.com/hashicorp/go-getter@v1.5.10
1.7.5

Open the chart page →

8,599
stackrox-chartredhat-cop0.0.101 of 1See more

stackrox-chart redhat-cop 0.0.10

1 of the 1 container images this version deploys carry CVE-2024-6257.

Container imageDigestPackageFixed in
quay.io/rht-labs/stack-do500:3.0.86ba82beff18e
github.com/hashicorp/go-getter@v1.5.2
1.7.5

Open the chart page →

29,227
devtron-enterpriseromholdings48.0.01 of 28See more

devtron-enterprise romholdings 48.0.0

1 of the 28 container images this version deploys carry CVE-2024-6257.

Container imageDigestPackageFixed in
quay.io/devtron/image-scanner:94237c18-109-3942098580969b333
github.com/hashicorp/go-getter@v1.7.2
1.7.5

Open the chart page →

68,240
hermitcrabseal-ioVerified publisher0.1.41 of 2See more

hermitcrab seal-io 0.1.4

1 of the 2 container images this version deploys carry CVE-2024-6257.

Container imageDigestPackageFixed in
sealio/terraform-deployer:v1.5.7-seal.1b0389d9848a5
github.com/hashicorp/go-getter@v1.7.0
1.7.5

Open the chart page →

4,881
keycloak-configuratorsikalabs0.2.01 of 1See more

keycloak-configurator sikalabs 0.2.0

1 of the 1 container images this version deploys carry CVE-2024-6257.

Container imageDigestPackageFixed in
hashicorp/terraform:1.44dcb45513699
github.com/hashicorp/go-getter@v1.7.0
1.7.5

Open the chart page →

2,863
harborsoftonic1.13.01 of 8See more

harbor softonic 1.13.0

1 of the 8 container images this version deploys carry CVE-2024-6257.

Container imageDigestPackageFixed in
goharbor/trivy-adapter-photon:v2.9.0dc5b882a7db4
github.com/hashicorp/go-getter@v1.7.1
1.7.5

Open the chart page →

7,672
trivy-operatorsoftonic0.18.01 of 1See more

trivy-operator softonic 0.18.0

1 of the 1 container images this version deploys carry CVE-2024-6257.

Container imageDigestPackageFixed in
ghcr.io/aquasecurity/trivy-operator:0.16.0a608b798fda5
github.com/hashicorp/go-getter@v1.7.1
1.7.5

Open the chart page →

2,505
harbor-scanner-trivytrivy-operator0.31.21 of 1See more

harbor-scanner-trivy trivy-operator 0.31.2

1 of the 1 container images this version deploys carry CVE-2024-6257.

Container imageDigestPackageFixed in
aquasec/harbor-scanner-trivy:0.31.26e790e233872
github.com/hashicorp/go-getter@v1.7.4
1.7.5

Open the chart page →

2,477

Container images carrying it

37 by charts deploying them

A fixed version is listed for 1 of the 1 affected package.

Container imageDigestPackageFixed inUsed by
quay.io/devtron/image-scanner:94237c18-109-3942098580969b333
github.com/hashicorp/go-getter@v1.7.2
1.7.5
3
anchore/anchore-engine:v0.10.0bde9eedf639d
github.com/hashicorp/go-getter@v1.4.1
1.7.5
1
aquasec/harbor-scanner-trivy:0.31.26e790e233872
github.com/hashicorp/go-getter@v1.7.4
1.7.5
1
aquasec/harbor-scanner-trivy:0.20.07ea4aa3d2eb6
github.com/hashicorp/go-getter@v1.5.2
1.7.5
1
aquasec/trivy:0.43.1944a04445179
github.com/hashicorp/go-getter@v1.7.1
1.7.5
1
aquasec/trivy:0.32.0973d0df16189
github.com/hashicorp/go-getter@v1.6.2
1.7.5
1
artifacthub/scanner:v1.19.0323d026e78c3
github.com/hashicorp/go-getter@v1.7.3
1.7.5
1
datadog/agent:6aad9994de6a7
github.com/hashicorp/go-getter@v1.7.4
1.7.5
1
devopstales/trivy-operator:2.575136aa7a26e
github.com/hashicorp/go-getter@v1.6.2
1.7.5
1
flanksource/apm-hub:v0.0.471dacc3195bf9
github.com/hashicorp/go-getter@v1.7.1
1.7.5
1
goharbor/trivy-adapter-photon:v2.5.3b9522c3f5056
github.com/hashicorp/go-getter@v1.6.2
1.7.5
1
goharbor/trivy-adapter-photon:v2.9.0dc5b882a7db4
github.com/hashicorp/go-getter@v1.7.1
1.7.5
1
hashicorp/terraform:1.44dcb45513699
github.com/hashicorp/go-getter@v1.7.0
1.7.5
1
hashicorp/waypoint:0.11.397d521a27498
github.com/hashicorp/go-getter@v1.7.0
1.7.5
1
runatlantis/atlantis:v0.16.145fbaf7e207c
github.com/hashicorp/go-getter@v1.5.1
1.7.5
1
sealio/terraform-deployer:v1.5.7-seal.1b0389d9848a5
github.com/hashicorp/go-getter@v1.7.0
1.7.5
1
tobirachel/node-project3:v17d9f37154994
github.com/hashicorp/go-getter@v1.5.4
1.7.5
1
tundeficky/nodejs-app:v1.0.03cf9a9ce54e8
github.com/hashicorp/go-getter@v1.5.4
1.7.5
1
ghcr.io/aquasecurity/trivy-operator:0.16.0a608b798fda5
github.com/hashicorp/go-getter@v1.7.1
1.7.5
1
ghcr.io/beluga-cloud/helm-dashboard/dashboard:1.3.39ab9a675c405
github.com/hashicorp/go-getter@v1.7.2
1.7.5
1
ghcr.io/camptocamp/terraboard:v2.3.0df53e2c8998c
github.com/hashicorp/go-getter@v1.7.3
1.7.5
1
ghcr.io/celestiaorg/celestia-app:v3.7.0-arabica23a9ec9b1879
github.com/hashicorp/go-getter@v1.7.4
1.7.5
1
ghcr.io/kubedb/provider-aws:v0.27.049b1c312e342
github.com/hashicorp/go-getter@v1.7.0
1.7.5
1
ghcr.io/kubedb/provider-azure:v0.27.0aa0c8526ae5e
github.com/hashicorp/go-getter@v1.6.2
1.7.5
1
ghcr.io/kubedb/provider-gcp:v0.27.0a1d4cf8b8fe1
github.com/hashicorp/go-getter@v1.6.2
1.7.5
1
ghcr.io/kubeform/provider-aws:v0.0.1e3d1f1302e49
github.com/hashicorp/go-getter@v1.6.2
1.7.5
1
ghcr.io/kubeform/provider-azure:v0.0.1ac8459f70f85
github.com/hashicorp/go-getter@v1.6.2
1.7.5
1
ghcr.io/kubeform/provider-gcp:v0.0.1af77073c184f
github.com/hashicorp/go-getter@v1.6.2
1.7.5
1
ghcr.io/kubeshop/botkube:v1.0.0669e27a5d1af
github.com/hashicorp/go-getter@v1.7.0
1.7.5
1
ghcr.io/m9sweeper/trawler:1.6.0df917c5a7e54
github.com/hashicorp/go-getter@v1.7.2
1.7.5
1
ghcr.io/openclarity/grype-server:v0.6.079412399f301
github.com/hashicorp/go-getter@v1.7.2
1.7.5
1
ghcr.io/pipe-cd/pipecd:v0.39.00fae829caf29
github.com/hashicorp/go-getter@v1.4.0
1.7.5
1
ghcr.io/runatlantis/atlantis:v0.47.1511231955463
github.com/hashicorp/go-getter@v1.7.4
1.7.5
1
quay.io/cloudnativetoolkit/cli-tools:v1.1-v1.8.2d6fd2a9e3273
github.com/hashicorp/go-getter@v1.5.7
1.7.5
1
quay.io/ibmgaragecloud/cli-tools:v0.159663f06adcb1
github.com/hashicorp/go-getter@v1.5.2
1.7.5
1
quay.io/redhat-appstudio/appstudio-utils:dbbdd82734232e6289e8fbae5b4c858481a7c0577b4202c25b67
github.com/hashicorp/go-getter@v1.5.10
1.7.5
1
quay.io/rht-labs/stack-do500:3.0.86ba82beff18e
github.com/hashicorp/go-getter@v1.5.2
1.7.5
1

syft 1.42.1 · advisories as of 14 Sept 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.