CyberRota Analysis
AI-GeneratedHashiCorp go-slug versions 0.4.0 to 0.18.2 are vulnerable to a local attack that can bypass .terraformignore exclusions, potentially leading to the inclusion of sensitive files in Terraform slug uploads. This vulnerability arises from improper handling of Unicode normalization during path matching. Organizations using affected versions should prioritize remediation to prevent unauthorized access to sensitive data.
CVE
CVE-2026-14978
Severity
MEDIUM
CVSS
5.5
EPSS
0.10%
Original NVD Description
HashiCorp go-slug 0.4.0 through 0.18.2 could allow a local attacker to bypass .terraformignore exclusions and cause sensitive files to be included in Terraform slug uploads due to improper handling of Unicode normalization during path matching.
Related CVEs
Other vulnerabilities affecting the same vendor(s)