GHSA-RJH2-4XGW-P2HJ Atlantis: OS command injection through PR-controlled Terraform workspace enables RCE during plan

Summary Atlantis passes the Terraform workspace value from a pull request's atlantis.yaml into a shell command without quoting or escaping it. A contributor whose pull request is eligible for an Atlantis plan can include shell metacharacters in the workspace name and execute arbitrary commands as...