medium5.5
CVE-2026-14978
HashiCorp go-slug 0.4.0 through 0.18.2 could allow a local attacker to bypass .terraformignore exclusions and cause sensitive files to be included in Terraform…
Impact
HashiCorp go-slug 0.4.0 through 0.18.2 could allow a local attacker to bypass .terraformignore exclusions and cause sensitive files to be included in Terraform slug uploads due to improper handling of Unicode normalization during path matching.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Hashicorp | Go-Slug | from 0.4.0 before 0.18.3 |