102 matches found
CVE-2026-45099
Terragrunt is a flexible orchestration tool that allows Infrastructure as Code written in OpenTofu or Terraform to scale. Prior to 1.0.4, Terragrunt trusts paths decoded from a downloaded module's .terragrunt-module-manifest during fileManifest.Clean in internal/util/file.go. A malicious or...
CVE-2026-45099
Terragrunt (an orchestration tool for OpenTofu/Terraform) prior to v1.0.4 is vulnerable to arbitrary file deletion via a maliciously crafted .terragrunt-module-manifest file in a downloaded external module. The root cause is that fileManifest.Clean() in internal/util/file.go trusted decoded paths...
CVE-2026-45099 Terragrunt: Arbitrary File Deletion via Malicious Module Manifest
Terragrunt is a flexible orchestration tool that allows Infrastructure as Code written in OpenTofu or Terraform to scale. Prior to 1.0.4, Terragrunt trusts paths decoded from a downloaded module's .terragrunt-module-manifest during fileManifest.Clean in internal/util/file.go. A malicious or...
CVE-2026-45099 Terragrunt: Arbitrary File Deletion via Malicious Module Manifest
Terragrunt is a flexible orchestration tool that allows Infrastructure as Code written in OpenTofu or Terraform to scale. Prior to 1.0.4, Terragrunt trusts paths decoded from a downloaded module's .terragrunt-module-manifest during fileManifest.Clean in internal/util/file.go. A malicious or...
GO-2026-6241 Terragrunt: Arbitrary File Deletion via Malicious Module Manifest in github.com/gruntwork-io/terragrunt
Terragrunt: Arbitrary File Deletion via Malicious Module Manifest in github.com/gruntwork-io/terragrunt...
GHSA-8394-6F8R-WHXG Terragrunt: Arbitrary File Deletion via Malicious Module Manifest
Summary Terragrunt is vulnerable to an arbitrary file deletion flaw when downloading external modules. If a remote module contains a maliciously crafted .terragrunt-module-manifest file, Terragrunt can be tricked into deleting files anywhere on the local filesystem that the Terragrunt process has...
Terragrunt: Arbitrary File Deletion via Malicious Module Manifest
Summary Terragrunt is vulnerable to an arbitrary file deletion flaw when downloading external modules. If a remote module contains a maliciously crafted .terragrunt-module-manifest file, Terragrunt can be tricked into deleting files anywhere on the local filesystem that the Terragrunt process has...
PT-2026-76888
Name of the Vulnerable Software and Affected Versions Terragrunt versions prior to 1.0.4 Description Terragrunt contains a flaw that allows arbitrary file deletion when downloading external modules. The issue occurs during the directory cleanup process within the fileManifest.Clean function locat...
GO-2024-2948 vulnerabilities
Vulnerabilities for packages: zarf, snyk-cli, terragrunt, conftest, k9s, terraform, kots, trivy, zot, trivy-fips, tflint, conftest-fips, tfsec, wolfictl, grype, kubescape...
GO-2024-2698 vulnerabilities
Vulnerabilities for packages: filebrowser, vault, zarf, k9s, nuclei, gotenberg, kots, wolfictl, terragrunt, kubescape, mattermost-fips, chainctl...
GO-2026-5490 vulnerabilities
Vulnerabilities for packages: chainloop-cli, chainloop-cli-fips, grafana-fips, gitaly, argo-cd-fips, flux-fips, terragrunt, amazon-ssm-agent, argo-cd, flux, cerbos, seaweedfs-rocksdb, telegraf, syft, packer, gitlab-rails-ce, packer-fips, seaweedfs-rocksdb-fips, syft-fips, upwind-agent, scorecard,...
GO-2026-4600 vulnerabilities
Vulnerabilities for packages: flux-source-watcher, podinfo, grafana-fips, cluster-autoscaler-fips, flux-image-automation-controller, amazon-k8s-cni-fips, flux-operator, go, grafana-operator-fips, metacontroller, victoriametrics, flux-fips, terragrunt, pluto, pgwatch, stakater-reloader,...
GO-2024-2698 vulnerabilities
Vulnerabilities for packages: k9s, kots, kubescape, nuclei, filebrowser, zarf, terragrunt, wolfictl...
GO-2025-3922 vulnerabilities
Vulnerabilities for packages: vcluster, trivy, zot, steampipe, filebrowser, zarf, trufflehog, gptscript, k9s, gitleaks, kubescape-operator, nsc, terraform, trivy-operator, gitness, nuclei, undock, guac, podman, xeol, envoy-gateway, grafana-alloy, terragrunt, opentofu, rancher-fleet, tflint...
GO-2026-4600 vulnerabilities
Vulnerabilities for packages: metacontroller, steampipe, nova, flux-helm-controller, flux-image-reflector-controller, flux-notification-controller, flux-image-automation-controller, pluto, grafana-operator, polaris, victoriametrics, go, podinfo, terragrunt, dkron, flux-source-controller,...
GO-2026-4514 vulnerabilities
Vulnerabilities for packages: vcluster, witness, kubevela, maru, terraform-mcp-server, minio, grafana, nuclei, rclone, teleport, datadog-agent, ollama, cri-tools, gitlab-runner, malcontent, k8sgpt, grafana-alloy, goreleaser, opentelemetry-collector, terragrunt, eksctl, dagger, redpanda, weaviate,...
GO-2026-5058 vulnerabilities
Vulnerabilities for packages: snyk-cli, kots, kubescape, trivy, zot, steampipe, zarf, syft, k9s, trivy-operator, terraform, tfsec, grype, xeol, terragrunt, opentofu, conftest, task, wolfictl, tflint...
GO-2026-4599 vulnerabilities
Vulnerabilities for packages: metacontroller, steampipe, nova, flux-helm-controller, flux-image-reflector-controller, flux-notification-controller, flux-image-automation-controller, pluto, grafana-operator, polaris, victoriametrics, go, podinfo, terragrunt, dkron, flux-source-controller,...
GO-2024-2978 vulnerabilities
Vulnerabilities for packages: gomplate, kube-rbac-proxy, tflint, vcluster, grafana-agent-operator, kots, step, trivy, zot, certificate-transparency, spire-server, zarf, cert-manager-cmctl, hubble-ui, spicedb, restic, ferretdb, temporal, minio, sops, spegel, kwok, sigstore-scaffolding, melange,...