CVE-2025-0377 is a high severity (7.5) zip-slip style path traversal flaw in HashiCorp go-slug, a Go library for unpacking Terraform slugs. It affects releases up to 0.16.2. HashiCorp fixed it in go-slug 0.16.3, so upgrade any Go module that depends on it.
What's affected
HashiCorp's bulletin HCSEC-2025-01 lists go-slug up to 0.16.2 as affected and go-slug 0.16.3 as the fix. It was published on January 21, 2025.
go-slug is a shared library for packing and unpacking Terraform Enterprise compatible slugs. A slug is a gzip compressed tar file that holds Terraform configuration files. The bulletin explains that when go-slug extracts a slug, it takes the extraction path from the name in each tar entry. The unpacking step validated that path poorly, which could lead to path traversal and let an attacker write an arbitrary file during extraction.
The record classifies the weakness as CWE-59, improper link resolution before file access. The CVSS vector is CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N, a network attack with no privileges and no user interaction, with a high confidentiality impact and no integrity or availability impact. The record does not mark the flaw as exploited in the wild, and it is not in the CISA Known Exploited Vulnerabilities catalog.
You may not depend on go-slug directly. It can arrive as an indirect dependency of another tool or service, which is why a version check on your module graph matters.
How to check if you're exposed
From the root of each Go module, list the version in use:
go list -m all | grep go-slug
If the module is present, the output shows its version. Anything at 0.16.2 or lower is affected. To see which of your dependencies pulls it in, ask Go for the dependency path:
go mod why -m github.com/hashicorp/go-slug
Check built binaries too. Go embeds module information in executables, so you can read it from a compiled program:
go version -m ./your-binary | grep go-slug
HashiCorp advises consumers to evaluate the risk in the context of how they use the library. If your code never unpacks slugs from a source you do not control, your exposure is smaller. Even so, the upgrade is a small change and removes the question.
What to do now
- Run the checks above on every Go repository and on deployed binaries.
- Upgrade to go-slug 0.16.3 or later. For a direct dependency, run
go get github.com/hashicorp/go-slug@v0.16.3, thengo mod tidy. - If go-slug is indirect, upgrade the parent module that requires it, or add a requirement on the fixed version in your own go.mod.
- Rebuild and redeploy the affected services. A fixed go.mod does not change binaries already running.
- Run your tests and any Terraform workflow tests that unpack slugs.
- Rescan the repository with the free Gold dependency scan to confirm the old version is gone.
Why it matters
Zip slip is a family of bugs where an archive entry's name is trusted as a path. An entry that climbs out of the target folder can write a file somewhere the program was never meant to touch. Defences are simple in principle: clean each entry path, join it to the destination, and confirm the result still sits inside the destination before writing.
Libraries like this one sit deep in build and deploy tooling, where a quiet file write can matter a lot. Reachability analysis helps here. It asks whether your code actually calls the unpacking function with input an outsider can influence, so you can order the work sensibly while still upgrading everywhere.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Which go-slug version fixes CVE-2025-0377?
HashiCorp names go-slug 0.16.3 as the fixed release. Versions up to 0.16.2 are affected.
Does go.sum or go.mod show me the version?
Yes. The go list command shows the version Go resolves for the module, and go version -m reads it from a compiled binary.
Sources
Last reviewed: 19 October 2026.
