102 matches found
CVE-2026-45099
Terragrunt is a flexible orchestration tool that allows Infrastructure as Code written in OpenTofu or Terraform to scale. Prior to 1.0.4, Terragrunt trusts paths decoded from a downloaded module's .terragrunt-module-manifest during fileManifest.Clean in internal/util/file.go. A malicious or...
CVE-2026-45099
Terragrunt (an orchestration tool for OpenTofu/Terraform) prior to v1.0.4 is vulnerable to arbitrary file deletion via a maliciously crafted .terragrunt-module-manifest file in a downloaded external module. The root cause is that fileManifest.Clean() in internal/util/file.go trusted decoded paths...
CVE-2026-45099 Terragrunt: Arbitrary File Deletion via Malicious Module Manifest
Terragrunt is a flexible orchestration tool that allows Infrastructure as Code written in OpenTofu or Terraform to scale. Prior to 1.0.4, Terragrunt trusts paths decoded from a downloaded module's .terragrunt-module-manifest during fileManifest.Clean in internal/util/file.go. A malicious or...
CVE-2026-45099 Terragrunt: Arbitrary File Deletion via Malicious Module Manifest
Terragrunt is a flexible orchestration tool that allows Infrastructure as Code written in OpenTofu or Terraform to scale. Prior to 1.0.4, Terragrunt trusts paths decoded from a downloaded module's .terragrunt-module-manifest during fileManifest.Clean in internal/util/file.go. A malicious or...
GO-2026-6241 Terragrunt: Arbitrary File Deletion via Malicious Module Manifest in github.com/gruntwork-io/terragrunt
Terragrunt: Arbitrary File Deletion via Malicious Module Manifest in github.com/gruntwork-io/terragrunt...
GHSA-8394-6F8R-WHXG Terragrunt: Arbitrary File Deletion via Malicious Module Manifest
Summary Terragrunt is vulnerable to an arbitrary file deletion flaw when downloading external modules. If a remote module contains a maliciously crafted .terragrunt-module-manifest file, Terragrunt can be tricked into deleting files anywhere on the local filesystem that the Terragrunt process has...
Terragrunt: Arbitrary File Deletion via Malicious Module Manifest
Summary Terragrunt is vulnerable to an arbitrary file deletion flaw when downloading external modules. If a remote module contains a maliciously crafted .terragrunt-module-manifest file, Terragrunt can be tricked into deleting files anywhere on the local filesystem that the Terragrunt process has...
PT-2026-76888
Name of the Vulnerable Software and Affected Versions Terragrunt versions prior to 1.0.4 Description Terragrunt contains a flaw that allows arbitrary file deletion when downloading external modules. The issue occurs during the directory cleanup process within the fileManifest.Clean function locat...
GO-2024-2948 vulnerabilities
Vulnerabilities for packages: tflint, tfsec, k9s, trivy-fips, wolfictl, conftest-fips, terraform, zarf, snyk-cli, kubescape, kots, terragrunt, trivy, grype, conftest, zot...
GO-2024-2698 vulnerabilities
Vulnerabilities for packages: wolfictl, k9s, mattermost-fips, nuclei, chainctl, vault, zarf, kots, terragrunt, gotenberg, kubescape, filebrowser...
GO-2026-5490 vulnerabilities
Vulnerabilities for packages: gitlab-rails-ce, rclone-fips, terragrunt-fips, seaweedfs-rocksdb, argo-cd, syft, argo-cd-fips, external-secrets-operator-fips, flux-fips, teleport, cerbos-fips, amazon-ssm-agent, scorecard, gitaly, external-secrets-operator, cg, kyverno-fips, packer, syft-fips,...
GO-2026-4600 vulnerabilities
Vulnerabilities for packages: aws-ebs-csi-driver, victoriametrics, amazon-k8s-cni-fips, flux-notification-controller, pgwatch, victoriametrics-cluster-fips, grafana-rollout-operator, flux-helm-controller, nova, go, flux-source-controller, pluto, dkron, steampipe, temporal-fips, victorialogs-fips,...
GO-2025-3922 vulnerabilities
Vulnerabilities for packages: gitleaks, zarf, zot, k9s, terragrunt, guac, kubescape-operator, rancher-fleet, gitness, tflint, podman, trivy, vcluster, undock, trufflehog, steampipe, opentofu, trivy-operator, nuclei, xeol, gptscript, nsc, terraform, grafana-alloy, envoy-gateway, filebrowser...
GO-2024-2698 vulnerabilities
Vulnerabilities for packages: zarf, kots, k9s, kubescape, terragrunt, wolfictl, filebrowser, nuclei...
GO-2026-5058 vulnerabilities
Vulnerabilities for packages: zarf, kots, zot, k9s, conftest, task, terragrunt, tflint, syft, trivy, grype, steampipe, kubescape, opentofu, snyk-cli, wolfictl, trivy-operator, xeol, tfsec, terraform...
GO-2026-4514 vulnerabilities
Vulnerabilities for packages: cri-tools, opentelemetry-collector-contrib, weaviate, terragrunt, minio, dgraph, gitlab-runner, datadog-agent, ollama, prometheus, loki, lazygit, kubevela, vcluster, redpanda, mcp-grafana, maru, terraform-mcp-server, nfpm, eksctl, k3s, k8sgpt, opentelemetry-collector...
GO-2026-4600 vulnerabilities
Vulnerabilities for packages: dkron, flux-image-automation-controller, flux-notification-controller, terragrunt, polaris, go, nova, pluto, flux-helm-controller, steampipe, victoriametrics-cluster, metacontroller, flux-source-controller, podinfo, stakater-reloader, victoriametrics,...
GO-2026-4599 vulnerabilities
Vulnerabilities for packages: dkron, flux-image-automation-controller, flux-notification-controller, terragrunt, polaris, go, nova, pluto, flux-helm-controller, steampipe, victoriametrics-cluster, metacontroller, flux-source-controller, podinfo, stakater-reloader, victoriametrics,...
GO-2024-2978 vulnerabilities
Vulnerabilities for packages: kaniko, zarf, opentelemetry-collector-contrib, kots, k8sgpt-operator, certificate-transparency, zot, conftest, kubernetes-csi-driver-hostpath, spicedb, terragrunt, spire-server, falcosidekick, hubble-ui, guac, grafana-mimir, melange, minio, sops,...