https://db.gcve.eu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Thu, 05 Nov 2026 00:20:41 +0000 https://db.gcve.eu/vuln/fkie_cve-2026-64672 <p>Terragrunt is a flexible orchestration tool that allows Infrastructure as Code written in OpenTofu or Terraform to scale. Prior to 1.1.1, the terragrunt catalog command derives a predictable per-repository catalog clone root under the shared system temporary directory and follows a symlink already placed at that path. A local attacker who can write to the temporary directory and predict the cataloged repository can redirect cleanup and cloning outside the intended root, causing an existing repository-named directory to be deleted and replaced in the victim&#39;s security context. The attack requires the victim to run terragrunt catalog on a shared host while the symlink is present, and it is not remotely exploitable. This issue is fixed in version 1.1.1.</p> <p>Terragrunt is a flexible orchestration tool that allows Infrastructure as Code written in OpenTofu or Terraform to scale. Prior to 1.1.1, the terragrunt catalog command derives a predictable per-repository catalog clone root under the shared system temporary directory and follows a symlink already placed at that path. A local attacker who can write to the temporary directory and predict the cataloged repository can redirect cleanup and cloning outside the intended root, causing an existing repository-named directory to be deleted and replaced in the victim&#39;s security context. The attack requires the victim to run terragrunt catalog on a shared host while the symlink is present, and it is not remotely exploitable. This issue is fixed in version 1.1.1.</p> https://db.gcve.eu/vuln/fkie_cve-2026-64672 https://db.gcve.eu/vuln/ghsa-wv6g-x823-wx9m <p><strong>Affected:</strong> Go: github.com/gruntwork-io/terragrunt</p> <p>### Summary</p> <p>Terragrunt&#39;s `terragrunt catalog` command clones each repository referenced in your catalog configuration into a temporary working directory. In affected versions, the clone path it derived was deterministic and sat under the shared system temporary directory, in the form `&lt;tmp&gt;/catalog-&lt;base64 sha1 of the repo URL&gt;`. Because that path was predictable and Terragrunt followed a symlink already present there instead of rejecting it, a local attacker could plant a symlink at that path and cause Terragrunt to delete a directory and re-clone into it outside the intended temporary root.</p> <p>### Impact</p> <p>This affected users who ran `terragrunt catalog` on a host they shared with other local users or processes they did not fully trust, such as a multi-user server or a shared CI runner. The attack required a local attacker: a separate local user or process able to write to the shared system temporary directory. It was not remotely exploitable, and the victim had to run `terragrunt catalog` while the attacker&#39;s symlink was already in place.</p> <p>Because the predictable path depended only on the repository URL being cataloged and the location of the system temporary directory, the attacker could compute it in advance and plant a symlink there before the victim ran the command. When the victim ran `terragrunt catalog`, Terragrunt followed the symlink out of the intended temporary root, deleted an existing `&lt;repoName&gt;` directory under the attacker-chosen parent, and repopulated that…</p> <p><strong>Affected:</strong> Go: github.com/gruntwork-io/terragrunt</p> <p>### Summary</p> <p>Terragrunt&#39;s `terragrunt catalog` command clones each repository referenced in your catalog configuration into a temporary working directory. In affected versions, the clone path it derived was deterministic and sat under the shared system temporary directory, in the form `&lt;tmp&gt;/catalog-&lt;base64 sha1 of the repo URL&gt;`. Because that path was predictable and Terragrunt followed a symlink already present there instead of rejecting it, a local attacker could plant a symlink at that path and cause Terragrunt to delete a directory and re-clone into it outside the intended temporary root.</p> <p>### Impact</p> <p>This affected users who ran `terragrunt catalog` on a host they shared with other local users or processes they did not fully trust, such as a multi-user server or a shared CI runner. The attack required a local attacker: a separate local user or process able to write to the shared system temporary directory. It was not remotely exploitable, and the victim had to run `terragrunt catalog` while the attacker&#39;s symlink was already in place.</p> <p>Because the predictable path depended only on the repository URL being cataloged and the location of the system temporary directory, the attacker could compute it in advance and plant a symlink there before the victim ran the command. When the victim ran `terragrunt catalog`, Terragrunt followed the symlink out of the intended temporary root, deleted an existing `&lt;repoName&gt;` directory under the attacker-chosen parent, and repopulated that…</p> https://db.gcve.eu/vuln/ghsa-wv6g-x823-wx9m