EUVD-2026-63099
GHSA-92x3-5h48-mfhx
Severity by source
AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
Placing Unicode-bypass files in a workspace requires at least local write access, warranting PR:L over PR:N; C:H retained as secrets exposure is realistic; no integrity or availability impact applies.
Primary rating from Vendor (us).
CVSS VectorVendor: us
Lifecycle Timeline
1DescriptionCVE.org
HashiCorp go-slug 0.4.0 through 0.18.2 could allow a local attacker to bypass .terraformignore exclusions and cause sensitive files to be included in Terraform slug uploads due to improper handling of Unicode normalization during path matching.
AnalysisAI
Unicode normalization mishandling in HashiCorp go-slug versions 0.4.0 through 0.18.2 enables a local attacker to circumvent .terraformignore exclusion rules, causing sensitive files to be silently bundled into Terraform slug uploads destined for remote backends. Exploitation requires local filesystem write access to the Terraform working directory and a legitimate operator triggering a slug upload operation - the CVSS vector confirms AV:L/UI:R, narrowing the realistic attack surface to shared workstations, multi-tenant CI/CD environments, or compromised developer machines. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Three concurrent conditions are required for exploitation: (1) the attacker must have local write access to the Terraform working directory, enabling placement of files with Unicode-normalized path components that bypass ignore rules - single-user workstations with exclusive directory ownership are not realistically exploitable; (2) the working directory must have a .terraformignore file with active exclusion rules, as the vulnerability only manifests when path-matching logic is invoked against defined exclusions; (3) a legitimate Terraform operator or automated CI/CD process must trigger a remote slug upload (terraform plan/apply against a remote backend, or equivalent API call) while attacker-influenced files are present in the workspace. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 base score of 5.5 (Medium) with vector AV:L/AC:L/PR:N/UI:R is broadly consistent with the described attack scenario, though the PR:N rating warrants scrutiny: placing Unicode-bypass files in a Terraform working directory realistically requires at least minimal write access to that directory, suggesting the actual privilege bar may be slightly higher than the vector implies - this is an explicit conflict between the vector and the description that defenders should verify with the vendor. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | The primary remediation is to upgrade the go-slug Go module to a version beyond 0.18.2 that incorporates the Unicode normalization fix; teams consuming this library should update their go.mod and go.sum files and rebuild any binaries that embed go-slug, including custom Terraform tooling or automation that invokes slug operations directly. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Credential-harvesting malware compromised 84 versions of 42 TanStack npm packages on 2026-05-11 via chained GitHub Actio
Unauthenticated remote attackers can trigger complete database overwrites, server-side file reads, and SSRF attacks agai
HashiCorp Terraform’s Vault Provider (terraform-provider-vault) did not correctly configure GCE-type bound labels for Va
An XML external entity (XXE) vulnerability in the Password Vault Web Access (PVWA) of CyberArk Enterprise Password Vault
PhotoRange Photo Vault 1.2 appends the password to the URI for authorization, which makes it easier for remote attackers
The REST API in CyberArk Password Vault Web Access before 9.9.5 and 10.x before 10.1 allows remote attackers to execute
Account takeover in self-hosted Bitwarden Server before 2026.6.0 lets a low-privileged organization member steal any oth
vault-cli is a configurable command-line interface tool (and python library) to interact with Hashicorp Vault. Rated cri
The SRP-6a implementation in Kee Vault KeePassRPC before 1.12.0 is missing validation for a client-provided parameter, w
The SRP-6a implementation in Kee Vault KeePassRPC before 1.12.0 generates insufficiently random numbers, which allows re
Server-side request forgery in the Ruby css_parser gem (< 3.0.0) lets a remote unauthenticated attacker force the parsin
HashiCorp Vagrant VMware Fusion plugin (aka vagrant-vmware-fusion) before 4.0.24 uses weak permissions for the sudo help
Same weakness CWE-176 – Improper Handling of Unicode Encoding
View allSame technique Information Disclosure
View allVendor StatusVendor
SUSE
Severity: Moderate| Product | Status |
|---|---|
| SUSE Linux Enterprise High Performance Computing 15 SP5 | Affected |
| SUSE Linux Enterprise Module for Public Cloud 15 SP4 | Affected |
| SUSE Linux Enterprise Module for Public Cloud 15 SP5 | Affected |
| SUSE Linux Enterprise Server 15 SP4 | Affected |
| SUSE Linux Enterprise Server 15 SP5 | Affected |
| SUSE Linux Enterprise Server for SAP Applications 15 SP4 | Affected |
| SUSE Linux Enterprise Server for SAP Applications 15 SP5 | Affected |
| SUSE Manager Proxy 4.3 | Affected |
| SUSE Manager Retail Branch Server 4.3 | Affected |
| SUSE Manager Server 4.3 | Affected |
| SUSE Enterprise Storage 7 | Affected |
| SUSE Enterprise Storage 7.1 | Affected |
| SUSE Linux Enterprise High Performance Computing 15 SP2 | Affected |
| SUSE Linux Enterprise High Performance Computing 15 SP3 | Affected |
| SUSE Linux Enterprise High Performance Computing 15 SP4 | Affected |
| SUSE Linux Enterprise Module for Public Cloud 15 SP2 | Affected |
| SUSE Linux Enterprise Module for Public Cloud 15 SP3 | Affected |
| SUSE Linux Enterprise Server 15 SP2 | Affected |
| SUSE Linux Enterprise Server 15 SP3 | Affected |
| SUSE Linux Enterprise Server for SAP Applications 15 SP2 | Affected |
| SUSE Linux Enterprise Server for SAP Applications 15 SP3 | Affected |
| SUSE Manager Proxy 4.1 | Affected |
| SUSE Manager Proxy 4.2 | Affected |
| SUSE Manager Retail Branch Server 4.1 | Affected |
| SUSE Manager Retail Branch Server 4.2 | Affected |
| SUSE Manager Server 4.1 | Affected |
| SUSE Manager Server 4.2 | Affected |
| openSUSE Leap 15.3 | Affected |
| openSUSE Leap 15.4 | Affected |
| openSUSE Leap 15.5 | Affected |
| openSUSE Leap 15.6 | Affected |
Share
External POC / Exploit Code
Leaving vuln.today