atlantis-android

Atlantis Android Capture HTTP/HTTPS traffic from Android apps and send to Proxyman for debugging. Overview Atlantis Android is a companion library to Proxyman that allows you to capture and inspect network traffic from your Android applications without configuring a proxy or installing...

aixcc-afc-atlantis

Atlantis This repository contains Atlantis , Team Atlanta's Cyber Reasoning System CRS submitted to the AIxCC Final Competition AFC. Atlantis is designed to automatically discover and analyze vulnerabilities in software systems. The main system implementation is located in the...

Atlantis: OS Command Injection Through PR-controlled Terraform Workspace Enables RCE During Plan

Summary Atlantis passes the Terraform "workspace" value from a pull request's "atlantis.yaml" into a shell command without quoting or escaping it. A contributor whose pull request is eligible for an Atlantis plan can include shell metacharacters in the workspace name and execute arbitrary command...

GHSA-RJH2-4XGW-P2HJ Atlantis: OS command injection through PR-controlled Terraform workspace enables RCE during plan

Summary Atlantis passes the Terraform workspace value from a pull request's atlantis.yaml into a shell command without quoting or escaping it. A contributor whose pull request is eligible for an Atlantis plan can include shell metacharacters in the workspace name and execute arbitrary commands as...

Atlantis: OS command injection through PR-controlled Terraform workspace enables RCE during plan

Summary Atlantis passes the Terraform workspace value from a pull request's atlantis.yaml into a shell command without quoting or escaping it. A contributor whose pull request is eligible for an Atlantis plan can include shell metacharacters in the workspace name and execute arbitrary commands as...

CVE-2026-116676

Atlantis is a self-hosted golang application that listens for Terraform pull request events via webhooks. From version 0.4.0 until 0.47.1, Atlantis passes the pull-request-controlled workspace value from atlantis.yaml into Terraform command arguments that are joined with strings.Joinargs, " " and...

CVE-2026-116676

Atlantis is a self-hosted golang application that listens for Terraform pull request events via webhooks. From version 0.4.0 until 0.47.1, Atlantis passes the pull-request-controlled workspace value from atlantis.yaml into Terraform command arguments that are joined with strings.Joinargs, " " and...

CVE-2026-116676 Atlantis: OS command injection through PR-controlled Terraform workspace enables RCE during plan

Atlantis is a self-hosted golang application that listens for Terraform pull request events via webhooks. From version 0.4.0 until 0.47.1, Atlantis passes the pull-request-controlled workspace value from atlantis.yaml into Terraform command arguments that are joined with strings.Joinargs, " " and...

CVE-2026-116676 Atlantis: OS command injection through PR-controlled Terraform workspace enables RCE during plan

Atlantis is a self-hosted golang application that listens for Terraform pull request events via webhooks. From version 0.4.0 until 0.47.1, Atlantis passes the pull-request-controlled workspace value from atlantis.yaml into Terraform command arguments that are joined with strings.Joinargs, " " and...

CVE-2026-116676

The Atlantis self-hosted Go application (versions 0.4.0 through 0.47.1) is vulnerable to OS command injection . The flaw exists because the application passes the pull-request-controlled workspace value from atlantis.yaml into Terraform command arguments, which are joined using strings.Join(args,...

EUVD-2026-111231

Atlantis is a self-hosted golang application that listens for Terraform pull request events via webhooks. From version 0.4.0 until 0.47.1, Atlantis passes the pull-request-controlled workspace value from atlantis.yaml into Terraform command arguments that are joined with strings.Joinargs, " " and...

CVE-2026-116676 Atlantis: OS command injection through PR-controlled Terraform workspace enables RCE during plan

Atlantis is a self-hosted golang application that listens for Terraform pull request events via webhooks. From version 0.4.0 until 0.47.1, Atlantis passes the pull-request-controlled workspace value from atlantis.yaml into Terraform command arguments that are joined with strings.Joinargs, " " and...

Atlantis command injection vulnerability

Versions 0.4.0 through 0.47.1 of Atlantis contain a command injection vulnerability. This vulnerability arises when values controlled by fetch requests in atlantis.yaml are concatenated into Terraform command parameters and executed via sh -c. Authenticated contributors can inject shell...

PT-2026-127754

Summary Atlantis passes the Terraform workspace value from a pull request's atlantis.yaml into a shell command without quoting or escaping it. A contributor whose pull request is eligible for an Atlantis plan can include shell metacharacters in the workspace name and execute arbitrary commands as...

PT-2026-126705

Name of the Vulnerable Software and Affected Versions Atlantis versions 0.4.0 through 0.47.0 Description Atlantis passes the workspace value from the atlantis.yaml file in a pull request into Terraform command arguments. These arguments are joined into a single string and executed via sh -c witho...

CVE-2026-116676: Improper Neutralization of Special Elements used in an OS Command

Atlantis is a self-hosted golang application that listens for Terraform pull request events via webhooks. From version 0.4.0 until 0.47.1, Atlantis passes the pull-request-controlled workspace value from atlantis.yaml into Terraform command arguments that are joined with strings.Joinargs, " " and...

CLEANSTART-2026-RG18594 malicious GOPROXY was previously capable of forging up to two sumdb tiles that allow for a requested module to bypass the GOSUMDB check and persist attacker-controlled module content to a local Go ...

Security vulnerability affects the atlantis package. A malicious GOPROXY was previously capable of forging up to two sumdb tiles that allow for a requested module to bypass the GOSUMDB check and persist attacker-controlled module content to a local Go module cache...

CLEANSTART-2026-RX61384 OpenTelemetry-Go is the Go implementation of OpenTelemetry

Security vulnerability affects the atlantis package. OpenTelemetry-Go is the Go implementation of OpenTelemetry...

CLEANSTART-2026-ND53090 OpenTelemetry-Go is the Go implementation of OpenTelemetry

Security vulnerability affects the atlantis package. OpenTelemetry-Go is the Go implementation of OpenTelemetry...

CLEANSTART-2026-WP85134 malicious GOSUMDB was capable of serving arbitrary module content not contained within the transparency log

Security vulnerability affects the atlantis package. A malicious GOSUMDB was capable of serving arbitrary module content not contained within the transparency log...