EUVD-2026-64035Severity by source
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Attacker needs no CI/CD privileges (PR:N); scope changes as the runner filesystem is accessed beyond the repository boundary (S:C); CI pipeline execution constitutes required user interaction (UI:R).
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
3DescriptionCVE.org
Infracost provides cloud cost intelligence for engineers, AI coding agents, and CI/CD. Prior to 0.10.45, the readFile, pathExists, isDir, and matchPaths template functions in internal/config/template/parser.go use a lexical filepath.Rel check and a leaf-only os.Lstat check that do not resolve an intermediate directory symlink. A repository can contain a path such as evil/file where evil points outside the checkout, causing os.ReadFile and related operations to follow the symlink and read runner-accessible files. The resulting content is rendered into generated configuration and can be surfaced through the Infracost dashboard or pull request comment, with greater impact in workflows that provide repository secrets. This issue is fixed in version 0.10.45.
AnalysisAI
Infracost's template engine prior to v0.10.45 allows repository-controlled symlinks to escape the checkout directory, enabling any contributor with repository write access to read files accessible to the CI/CD runner. The vulnerable template functions - readFile, pathExists, isDir, and matchPaths in internal/config/template/parser.go - relied on lexical filepath.Abs normalization and leaf-only os.Lstat checks that failed to resolve intermediate directory symlinks, so a path like evil/secret passes validation while physically exiting the repository root. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires the attacker to have repository write access or pull-request submission rights to a repository where Infracost processes template configurations in CI/CD. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 score of 5.9 (Medium) reflects two key limiting factors: AT:P (specific attack prerequisites - attacker must have repository write access to commit a symlink) and UI:A (user interaction - the CI/CD pipeline must execute Infracost against the repository). … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade to Infracost v0.10.45, the vendor-released patch confirmed by the tagged release at https://github.com/infracost/infracost/releases/tag/v0.10.45 and verifiable via commit 4d39331afc0e27752d16d9d91c34583e5e8487fb in PR #3586. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-22 – Path Traversal
View allSame technique Path Traversal
View allShare
External POC / Exploit Code
Leaving vuln.today