GHSA-MMG6-4QMV-6PC8
Vulnerability from github – Published: 2026-09-08 18:14 – Updated: 2026-09-08 18:14Impact
Path traversal via link following in the Infracost config-template parser. The readFile, pathExists, isDir, and matchPaths template functions confined repo-supplied paths with a lexical filepath.Rel check plus a leaf-only os.Lstat:
{{ readFile "evil/file" }}
With an intermediate directory symlink committed in the repo (evil -> /), the path is lexically clean and the leaf is a regular file, so both checks pass, but os.ReadFile follows the symlink and reads outside the checkout. The contents are rendered into the generated config and surfaced via the Infracost dashboard and PR comment, so anyone who can open a pull request can read files off the runner.
Affects infracost up to and including v0.10.44. Successful exploitation reads any file the CLI process can reach on the runner. Impact depends on what the run exposes: under on: pull_request (the configuration in Infracost's documentation) fork pull requests run without secrets and with a read-only token, so exposure is limited. If Infracost runs under pull_request_target, or is triggered by a same-repository pull request, the read reaches the repository's secrets, enabling secret theft. The patch confines all four functions regardless of trigger.
Patches
Fixed in v0.10.45 (#3586) by routing all four functions through security.IsPathAllowed, which resolves symlinks anywhere in the path before a segment-aware containment check. The same fix landed in config#14 and parser#144.
- Installed via the official script, a package manager, or the latest Docker tag: upgrade to v0.10.45 (or later) to receive the fix.
- Pinned to a specific version or image digest: bump to v0.10.45.
Workarounds
No full fix without upgrading. To limit exposure: run Infracost under on: pull_request rather than pull_request_target, and keep fork pull requests from receiving secrets (the defaults).
{
"affected": [
{
"package": {
"ecosystem": "Go",
"name": "github.com/infracost/infracost"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "0.10.45"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2026-71493"
],
"database_specific": {
"cwe_ids": [
"CWE-22",
"CWE-59"
],
"github_reviewed": true,
"github_reviewed_at": "2026-09-08T18:14:00Z",
"nvd_published_at": "2026-08-21T18:16:50Z",
"severity": "MODERATE"
},
"details": "### Impact\n\nPath traversal via link following in the Infracost config-template parser. The `readFile`, `pathExists`, `isDir`, and `matchPaths` template functions confined repo-supplied paths with a lexical `filepath.Rel` check plus a leaf-only `os.Lstat`:\n\n```\n{{ readFile \"evil/file\" }}\n```\n\nWith an intermediate directory symlink committed in the repo (`evil -\u003e /`), the path is lexically clean and the leaf is a regular file, so both checks pass, but `os.ReadFile` follows the symlink and reads outside the checkout. The contents are rendered into the generated config and surfaced via the Infracost dashboard and PR comment, so anyone who can open a pull request can read files off the runner.\n\nAffects `infracost` up to and including `v0.10.44`. Successful exploitation reads any file the CLI process can reach on the runner. Impact depends on what the run exposes: under `on: pull_request` (the configuration in Infracost\u0027s documentation) fork pull requests run without secrets and with a read-only token, so exposure is limited. If Infracost runs under `pull_request_target`, or is triggered by a same-repository pull request, the read reaches the repository\u0027s secrets, enabling secret theft. The patch confines all four functions regardless of trigger.\n\n### Patches\n\nFixed in `v0.10.45` ([#3586](https://github.com/infracost/infracost/pull/3586)) by routing all four functions through `security.IsPathAllowed`, which resolves symlinks anywhere in the path before a segment-aware containment check. The same fix landed in [config#14](https://github.com/infracost/config/pull/14) and [parser#144](https://github.com/infracost/parser/pull/144).\n - Installed via the official script, a package manager, or the `latest` Docker tag: upgrade to `v0.10.45` (or later) to receive the fix.\n - Pinned to a specific version or image digest: bump to `v0.10.45`.\n\n### Workarounds\n\nNo full fix without upgrading. To limit exposure: run Infracost under `on: pull_request` rather than `pull_request_target`, and keep fork pull requests from receiving secrets (the defaults).",
"id": "GHSA-mmg6-4qmv-6pc8",
"modified": "2026-09-08T18:14:00Z",
"published": "2026-09-08T18:14:00Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/infracost/infracost/security/advisories/GHSA-mmg6-4qmv-6pc8"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-71493"
},
{
"type": "WEB",
"url": "https://github.com/infracost/infracost/pull/3586"
},
{
"type": "WEB",
"url": "https://github.com/infracost/infracost/commit/4d39331afc0e27752d16d9d91c34583e5e8487fb"
},
{
"type": "PACKAGE",
"url": "https://github.com/infracost/infracost"
},
{
"type": "WEB",
"url": "https://github.com/infracost/infracost/releases/tag/v0.10.45"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
"type": "CVSS_V4"
}
],
"summary": "Infracost: Arbitrary file read via config-template readFile symlink traversal"
}
Drag nodes to arrange them. Double-click a related vulnerability to open it, or a source to visit its link. The Physics button on the left tunes the layout and the simulation; the legend at the bottom left hides or shows nodes by kind and by sighting type.
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Vulnerability timeline
Sightings and recorded dates, grouped by day · UTC
How durations are calculated
Following the VTEM framework (Black Hat USA 2015), time to patch starts when the vendor or a coordinator was informed, total time to patch at discovery, and disclosure to patch at public disclosure; vendor response time runs from the report to its acknowledgement. Time to exploit and time unpatched start at the earliest discovery or report, falling back to public disclosure. Unpatched time ends at the first recorded patch, or the calculation time when no patch is recorded. Exploitation to patch shows the interval between those two events; a published proof of concept is a public exploit, not exploitation.
Each result shows its source dates. A negative interval means the end event came first; when date-only inputs leave the order open, the result says so. Date-only inputs are approximate. The earliest evidence wins: KEV report dates and sightings are labelled as such. Records describing another vulnerability are listed but never calculated from, and a PoC alone does not establish exploitation. Missing patch evidence does not prove that no patch exists. Filters below change the event list only.
Loading timeline…
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
Related by attack behaviour
Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.