StackRadarChart IndexLive demo

CVE-2025-0377

High

Advisory

Published 21 Jan 2025In the index since 5 Sept 2026

Severity: High; worst across findings
CVSS: 7.5; base score, highest
EPSS: 0.007; 51st percentile
CISA KEV: Not listed; no confirmed exploitation
Charts affected: 33; of 17,781 indexed, latest versions
Container images: 30; deployed by those charts
Fix available: 1 of 1; affected package

HashiCorp go-slug Vulnerable to Zip Slip Attack

Carried by container images the latest versions of 33 of 17,781 indexed charts deploy, on 30 images.

Affected package	Affected versions	Fixed in	Images
github.com/hashicorp/go-sluggolang	v0.4.1, v0.7.0, v0.8.0, v0.8.1+6 more	0.16.3	30

OSV records: GHSA-wpfp-cm49-9m9q
Also known as: GO-2025-3413

Charts affected

33 by stars

Chart

Latest

Affected images

Radar Score

terraformhashicorp

1 of 1 See more

terraform hashicorp 1.1.2

1 of the 1 container images this version deploys carry CVE-2025-0377.

Container image	Digest	Package	Fixed in
hashicorp/terraform-k8s :1.1.2	b19857bab620	github.com/hashicorp/go-slug@v0.7.0	0.16.3

Open the chart page →

2,059

atlantisatlantis

1 of 1 See more

atlantis atlantis 6.15.0

1 of the 1 container images this version deploys carry CVE-2025-0377.

Container image	Digest	Package	Fixed in
ghcr.io/runatlantis/atlantis :v0.47.1	511231955463	github.com/hashicorp/go-slug@v0.15.0	0.16.3

Open the chart page →

1,891

emqx-operatoremqx-operator

1 of 2 See more

emqx-operator emqx-operator 2.3.2

1 of the 2 container images this version deploys carry CVE-2025-0377.

Container image	Digest	Package	Fixed in
alpine/k8s :1.31.4	9c4976d47656	github.com/hashicorp/go-slug@v0.15.0	0.16.3

Open the chart page →

4,531

sn-platformstreamnative

1 of 9 See more

sn-platform streamnative 1.11.44

1 of the 9 container images this version deploys carry CVE-2025-0377.

Container image	Digest	Package	Fixed in
streamnative/pulsar_vault_init :v1.0.7	31533fa9fab7	github.com/hashicorp/go-slug@v0.7.0	0.16.3

Open the chart page →

15,477

terraform-cloud-operatorhashicorp

1 of 2 See more

terraform-cloud-operator hashicorp 2.5.0

1 of the 2 container images this version deploys carry CVE-2025-0377.

Container image	Digest	Package	Fixed in
hashicorp/terraform-cloud-operator :2.5.0	c2f78a575a8a	github.com/hashicorp/go-slug@v0.15.0	0.16.3

Open the chart page →

1,463

1 of 1 See more

atlantis trozz 3.12.11

1 of the 1 container images this version deploys carry CVE-2025-0377.

Container image	Digest	Package	Fixed in
runatlantis/atlantis :v0.16.1	45fbaf7e207c	github.com/hashicorp/go-slug@v0.4.1	0.16.3

Open the chart page →

5,280

upbot-operatorupbot-operator

1 of 2 See more

upbot-operator upbot-operator 0.0.20

1 of the 2 container images this version deploys carry CVE-2025-0377.

Container image	Digest	Package	Fixed in
alpine/k8s :1.28.13	e5c0b053fed7	github.com/hashicorp/go-slug@v0.15.0	0.16.3

Open the chart page →

4,460

amorphieamorphie

1 of 18 See more

amorphie amorphie 0.1.2

1 of the 18 container images this version deploys carry CVE-2025-0377.

Container image	Digest	Package	Fixed in
hashicorp/vault :1.15.2	6b4e5dadf082	github.com/hashicorp/go-slug@v0.12.1	0.16.3

Open the chart page →

28,131

kubedb-provider-awsappscode

1 of 1 See more

kubedb-provider-aws appscode 2026.7.10

1 of the 1 container images this version deploys carry CVE-2025-0377.

Container image	Digest	Package	Fixed in
ghcr.io/kubedb/provider-aws :v0.27.0	49b1c312e342	github.com/hashicorp/go-slug@v0.11.1	0.16.3

Open the chart page →

2,527

kubedb-provider-azureappscode

1 of 1 See more

kubedb-provider-azure appscode 2026.7.10

1 of the 1 container images this version deploys carry CVE-2025-0377.

Container image	Digest	Package	Fixed in
ghcr.io/kubedb/provider-azure :v0.27.0	aa0c8526ae5e	github.com/hashicorp/go-slug@v0.10.0	0.16.3

Open the chart page →

2,705

kubedb-provider-gcpappscode

1 of 2 See more

kubedb-provider-gcp appscode 2026.7.10

1 of the 2 container images this version deploys carry CVE-2025-0377.

Container image	Digest	Package	Fixed in
ghcr.io/kubedb/provider-gcp :v0.27.0	a1d4cf8b8fe1	github.com/hashicorp/go-slug@v0.10.0	0.16.3

Open the chart page →

3,033

kubeform-provider-awsappscode

1 of 1 See more

kubeform-provider-aws appscode 2023.11.1

1 of the 1 container images this version deploys carry CVE-2025-0377.

Container image	Digest	Package	Fixed in
ghcr.io/kubeform/provider-aws :v0.0.1	e3d1f1302e49	github.com/hashicorp/go-slug@v0.10.0	0.16.3

Open the chart page →

2,796

kubeform-provider-azureappscode

1 of 1 See more

kubeform-provider-azure appscode 2023.11.1

1 of the 1 container images this version deploys carry CVE-2025-0377.

Container image	Digest	Package	Fixed in
ghcr.io/kubeform/provider-azure :v0.0.1	ac8459f70f85	github.com/hashicorp/go-slug@v0.10.0	0.16.3

Open the chart page →

2,716

kubeform-provider-gcpappscode

1 of 1 See more

kubeform-provider-gcp appscode 2023.11.1

1 of the 1 container images this version deploys carry CVE-2025-0377.

Container image	Digest	Package	Fixed in
ghcr.io/kubeform/provider-gcp :v0.0.1	af77073c184f	github.com/hashicorp/go-slug@v0.10.0	0.16.3

Open the chart page →

2,743

argonix-apiargonix

1 of 4 See more

argonix-api argonix 0.2.0

1 of the 4 container images this version deploys carry CVE-2025-0377.

Container image	Digest	Package	Fixed in
ghcr.io/argonix-io/argonix-api :1.0.0	68e17a8aaa40	github.com/hashicorp/go-slug@v0.15.0	0.16.3

Open the chart page →

4,923

firehoseblip-firehose

1 of 11 See more

firehose blip-firehose 0.0.18

1 of the 11 container images this version deploys carry CVE-2025-0377.

Container image	Digest	Package	Fixed in
hashicorp/vault :1.15.2	6b4e5dadf082	github.com/hashicorp/go-slug@v0.12.1	0.16.3

Open the chart page →

13,459

terraboardcamptocamp3

1 of 1 See more

terraboard camptocamp3 2.4.0

1 of the 1 container images this version deploys carry CVE-2025-0377.

Container image	Digest	Package	Fixed in
ghcr.io/camptocamp/terraboard :v2.3.0	df53e2c8998c	github.com/hashicorp/go-slug@v0.12.2	0.16.3

Open the chart page →

1,330

cp4d-deployercloud-native-toolkit

1 of 1 See more

cp4d-deployer cloud-native-toolkit 1.0.0

1 of the 1 container images this version deploys carry CVE-2025-0377.

Container image	Digest	Package	Fixed in
quay.io/cloudnativetoolkit/cloud-pak-deployer :latest	13aaae779248	github.com/hashicorp/go-slug@v0.11.1	0.16.3

Open the chart page →

25,151

ibm-toolkit-installcloud-native-toolkit

1 of 1 See more

ibm-toolkit-install cloud-native-toolkit 0.3.0

1 of the 1 container images this version deploys carry CVE-2025-0377.

Container image	Digest	Package	Fixed in
quay.io/ibmgaragecloud/cli-tools :v0.15	9663f06adcb1	github.com/hashicorp/go-slug@v0.4.1	0.16.3

Open the chart page →

6,695

iteration-zerocloud-native-toolkit

1 of 1 See more

iteration-zero cloud-native-toolkit 0.2.0

1 of the 1 container images this version deploys carry CVE-2025-0377.

Container image	Digest	Package	Fixed in
quay.io/cloudnativetoolkit/cli-tools :v1.1-v1.8.2	d6fd2a9e3273	github.com/hashicorp/go-slug@v0.8.0	0.16.3

Open the chart page →

6,921

electric-mailcryptexlabs

1 of 5 See more

electric-mail cryptexlabs 0.0.1

1 of the 5 container images this version deploys carry CVE-2025-0377.

Container image	Digest	Package	Fixed in
hashicorp/vault :1.8.3	4db614d40d0e	github.com/hashicorp/go-slug@v0.4.1	0.16.3

Open the chart page →

5,973

purple-piecryptexlabs

1 of 4 See more

purple-pie cryptexlabs 0.0.1

1 of the 4 container images this version deploys carry CVE-2025-0377.

Container image	Digest	Package	Fixed in
hashicorp/vault :1.8.3	4db614d40d0e	github.com/hashicorp/go-slug@v0.4.1	0.16.3

Open the chart page →

5,973

1 of 2 See more

evi-vault intel 3.0.3

1 of the 2 container images this version deploys carry CVE-2025-0377.

Container image	Digest	Package	Fixed in
hashicorp/vault :1.12.1	8de4d5f31b38	github.com/hashicorp/go-slug@v0.7.0	0.16.3

Open the chart page →

4,478

vaultintel

1 of 2 See more

vault intel 0.8.1

1 of the 2 container images this version deploys carry CVE-2025-0377.

Container image	Digest	Package	Fixed in
hashicorp/vault :1.12.1	8de4d5f31b38	github.com/hashicorp/go-slug@v0.7.0	0.16.3

Open the chart page →

4,478

hetzner-dyndnsitsmethemojo

1 of 1 See more

hetzner-dyndns itsmethemojo 1.4.0

1 of the 1 container images this version deploys carry CVE-2025-0377.

Container image	Digest	Package	Fixed in
hashicorp/terraform :1.9.7	b77efab1a448	github.com/hashicorp/go-slug@v0.15.0	0.16.3

Open the chart page →

1,836

vaultjfrog

1 of 2 See more

vault jfrog 0.25.0

1 of the 2 container images this version deploys carry CVE-2025-0377.

Container image	Digest	Package	Fixed in
hashicorp/vault :1.14.0	b2177a8bfe85	github.com/hashicorp/go-slug@v0.11.1	0.16.3

Open the chart page →

3,968

vault-helm-chartnotesprojectchart

1 of 1 See more

vault-helm-chart notesprojectchart 0.1.0

1 of the 1 container images this version deploys carry CVE-2025-0377.

Container image	Digest	Package	Fixed in
library/vault :1.13.3	f98ac9dd97b0	github.com/hashicorp/go-slug@v0.7.0	0.16.3

Open the chart page →

2,246

planectlplanectl

1 of 10 See more

planectl planectl 0.7.0

1 of the 10 container images this version deploys carry CVE-2025-0377.

Container image	Digest	Package	Fixed in
alpine/k8s :1.30.2	cd560fce90f7	github.com/hashicorp/go-slug@v0.15.0	0.16.3

Open the chart page →

25,934

krr-enforcerrobusta

1 of 2 See more

krr-enforcer robusta 0.3.5

1 of the 2 container images this version deploys carry CVE-2025-0377.

Container image	Digest	Package	Fixed in
alpine/k8s :1.30.0	bd01dae02676	github.com/hashicorp/go-slug@v0.8.1	0.16.3

Open the chart page →

4,038

hermitcrabseal-io

1 of 2 See more

hermitcrab seal-io 0.1.4

1 of the 2 container images this version deploys carry CVE-2025-0377.

Container image	Digest	Package	Fixed in
sealio/terraform-deployer :v1.5.7-seal.1	b0389d9848a5	github.com/hashicorp/go-slug@v0.11.1	0.16.3

Open the chart page →

4,881

keycloak-configuratorsikalabs

1 of 1 See more

keycloak-configurator sikalabs 0.2.0

1 of the 1 container images this version deploys carry CVE-2025-0377.

Container image	Digest	Package	Fixed in
hashicorp/terraform :1.4	4dcb45513699	github.com/hashicorp/go-slug@v0.11.0	0.16.3

Open the chart page →

2,863

vaultstakater

1 of 2 See more

vault stakater 0.8.4

1 of the 2 container images this version deploys carry CVE-2025-0377.

Container image	Digest	Package	Fixed in
hashicorp/vault :1.8.4	dfc3500beb0e	github.com/hashicorp/go-slug@v0.4.1	0.16.3

Open the chart page →

5,864

wexa-studiowexa-studio

1 of 15 See more

wexa-studio wexa-studio 1.2.0

1 of the 15 container images this version deploys carry CVE-2025-0377.

Container image	Digest	Package	Fixed in
hashicorp/vault :1.15.4	0b01ed3924e6	github.com/hashicorp/go-slug@v0.12.1	0.16.3

Open the chart page →

14,983

Container images carrying it

30 by charts deploying them

A fixed version is listed for 1 of the 1 affected package.

Container image	Digest	Package	Fixed in	Used by
hashicorp/vault :1.8.3	4db614d40d0e	github.com/hashicorp/go-slug@v0.4.1	0.16.3	2
hashicorp/vault :1.15.2	6b4e5dadf082	github.com/hashicorp/go-slug@v0.12.1	0.16.3	2
hashicorp/vault :1.12.1	8de4d5f31b38	github.com/hashicorp/go-slug@v0.7.0	0.16.3	2
alpine/k8s :1.31.4	9c4976d47656	github.com/hashicorp/go-slug@v0.15.0	0.16.3	1
alpine/k8s :1.30.0	bd01dae02676	github.com/hashicorp/go-slug@v0.8.1	0.16.3	1
alpine/k8s :1.30.2	cd560fce90f7	github.com/hashicorp/go-slug@v0.15.0	0.16.3	1
alpine/k8s :1.28.13	e5c0b053fed7	github.com/hashicorp/go-slug@v0.15.0	0.16.3	1
hashicorp/terraform :1.4	4dcb45513699	github.com/hashicorp/go-slug@v0.11.0	0.16.3	1
hashicorp/terraform :1.9.7	b77efab1a448	github.com/hashicorp/go-slug@v0.15.0	0.16.3	1
hashicorp/terraform-cloud-operator :2.5.0	c2f78a575a8a	github.com/hashicorp/go-slug@v0.15.0	0.16.3	1
hashicorp/terraform-k8s :1.1.2	b19857bab620	github.com/hashicorp/go-slug@v0.7.0	0.16.3	1
hashicorp/vault :1.15.4	0b01ed3924e6	github.com/hashicorp/go-slug@v0.12.1	0.16.3	1
hashicorp/vault :1.14.0	b2177a8bfe85	github.com/hashicorp/go-slug@v0.11.1	0.16.3	1
hashicorp/vault :1.8.4	dfc3500beb0e	github.com/hashicorp/go-slug@v0.4.1	0.16.3	1
library/vault :1.13.3	f98ac9dd97b0	github.com/hashicorp/go-slug@v0.7.0	0.16.3	1
runatlantis/atlantis :v0.16.1	45fbaf7e207c	github.com/hashicorp/go-slug@v0.4.1	0.16.3	1
sealio/terraform-deployer :v1.5.7-seal.1	b0389d9848a5	github.com/hashicorp/go-slug@v0.11.1	0.16.3	1
streamnative/pulsar_vault_init :v1.0.7	31533fa9fab7	github.com/hashicorp/go-slug@v0.7.0	0.16.3	1
ghcr.io/argonix-io/argonix-api :1.0.0	68e17a8aaa40	github.com/hashicorp/go-slug@v0.15.0	0.16.3	1
ghcr.io/camptocamp/terraboard :v2.3.0	df53e2c8998c	github.com/hashicorp/go-slug@v0.12.2	0.16.3	1
ghcr.io/kubedb/provider-aws :v0.27.0	49b1c312e342	github.com/hashicorp/go-slug@v0.11.1	0.16.3	1
ghcr.io/kubedb/provider-azure :v0.27.0	aa0c8526ae5e	github.com/hashicorp/go-slug@v0.10.0	0.16.3	1
ghcr.io/kubedb/provider-gcp :v0.27.0	a1d4cf8b8fe1	github.com/hashicorp/go-slug@v0.10.0	0.16.3	1
ghcr.io/kubeform/provider-aws :v0.0.1	e3d1f1302e49	github.com/hashicorp/go-slug@v0.10.0	0.16.3	1
ghcr.io/kubeform/provider-azure :v0.0.1	ac8459f70f85	github.com/hashicorp/go-slug@v0.10.0	0.16.3	1
ghcr.io/kubeform/provider-gcp :v0.0.1	af77073c184f	github.com/hashicorp/go-slug@v0.10.0	0.16.3	1
ghcr.io/runatlantis/atlantis :v0.47.1	511231955463	github.com/hashicorp/go-slug@v0.15.0	0.16.3	1
quay.io/cloudnativetoolkit/cli-tools :v1.1-v1.8.2	d6fd2a9e3273	github.com/hashicorp/go-slug@v0.8.0	0.16.3	1
quay.io/cloudnativetoolkit/cloud-pak-deployer :latest	13aaae779248	github.com/hashicorp/go-slug@v0.11.1	0.16.3	1
quay.io/ibmgaragecloud/cli-tools :v0.15	9663f06adcb1	github.com/hashicorp/go-slug@v0.4.1	0.16.3	1