EUVD-2026-63099
GHSA-92x3-5h48-mfhx
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Placing Unicode-bypass files in a workspace requires at least local write access, warranting PR:L over PR:N; C:H retained as secrets exposure is realistic; no integrity or availability impact applies.
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
1DescriptionNVD
HashiCorp go-slug 0.4.0 through 0.18.2 could allow a local attacker to bypass .terraformignore exclusions and cause sensitive files to be included in Terraform slug uploads due to improper handling of Unicode normalization during path matching.
AnalysisAI
Unicode normalization mishandling in HashiCorp go-slug versions 0.4.0 through 0.18.2 enables a local attacker to circumvent .terraformignore exclusion rules, causing sensitive files to be silently bundled into Terraform slug uploads destined for remote backends. Exploitation requires local filesystem write access to the Terraform working directory and a legitimate operator triggering a slug upload operation - the CVSS vector confirms AV:L/UI:R, narrowing the realistic attack surface to shared workstations, multi-tenant CI/CD environments, or compromised developer machines. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Three concurrent conditions are required for exploitation: (1) the attacker must have local write access to the Terraform working directory, enabling placement of files with Unicode-normalized path components that bypass ignore rules - single-user workstations with exclusive directory ownership are not realistically exploitable; (2) the working directory must have a .terraformignore file with active exclusion rules, as the vulnerability only manifests when path-matching logic is invoked against defined exclusions; (3) a legitimate Terraform operator or automated CI/CD process must trigger a remote slug upload (terraform plan/apply against a remote backend, or equivalent API call) while attacker-influenced files are present in the workspace. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 base score of 5.5 (Medium) with vector AV:L/AC:L/PR:N/UI:R is broadly consistent with the described attack scenario, though the PR:N rating warrants scrutiny: placing Unicode-bypass files in a Terraform working directory realistically requires at least minimal write access to that directory, suggesting the actual privilege bar may be slightly higher than the vector implies - this is an explicit conflict between the vector and the description that defenders should verify with the vendor. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | The primary remediation is to upgrade the go-slug Go module to a version beyond 0.18.2 that incorporates the Unicode normalization fix; teams consuming this library should update their go.mod and go.sum files and rebuild any binaries that embed go-slug, including custom Terraform tooling or automation that invokes slug operations directly. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
HashiCorp go-slug up to 0.4.3 did not fully protect against directory traversal while unpacking tar archives, and protec
HashiCorp’s go-slug library is vulnerable to a zip-slip style attack when a non-existing user-provided path is extracted
Same weakness CWE-176 – Improper Handling of Unicode Encoding
View allSame technique Information Disclosure
View allVendor StatusVendor
SUSE
Severity: Moderate| Product | Status |
|---|---|
| SUSE Linux Enterprise High Performance Computing 15 SP5 | Affected |
| SUSE Linux Enterprise Module for Public Cloud 15 SP4 | Affected |
| SUSE Linux Enterprise Module for Public Cloud 15 SP5 | Affected |
| SUSE Linux Enterprise Server 15 SP4 | Affected |
| SUSE Linux Enterprise Server 15 SP5 | Affected |
| SUSE Linux Enterprise Server for SAP Applications 15 SP4 | Affected |
| SUSE Linux Enterprise Server for SAP Applications 15 SP5 | Affected |
| SUSE Manager Proxy 4.3 | Affected |
| SUSE Manager Retail Branch Server 4.3 | Affected |
| SUSE Manager Server 4.3 | Affected |
| SUSE Enterprise Storage 7 | Affected |
| SUSE Enterprise Storage 7.1 | Affected |
| SUSE Linux Enterprise High Performance Computing 15 SP2 | Affected |
| SUSE Linux Enterprise High Performance Computing 15 SP3 | Affected |
| SUSE Linux Enterprise High Performance Computing 15 SP4 | Affected |
| SUSE Linux Enterprise Module for Public Cloud 15 SP2 | Affected |
| SUSE Linux Enterprise Module for Public Cloud 15 SP3 | Affected |
| SUSE Linux Enterprise Server 15 SP2 | Affected |
| SUSE Linux Enterprise Server 15 SP3 | Affected |
| SUSE Linux Enterprise Server for SAP Applications 15 SP2 | Affected |
| SUSE Linux Enterprise Server for SAP Applications 15 SP3 | Affected |
| SUSE Manager Proxy 4.1 | Affected |
| SUSE Manager Proxy 4.2 | Affected |
| SUSE Manager Retail Branch Server 4.1 | Affected |
| SUSE Manager Retail Branch Server 4.2 | Affected |
| SUSE Manager Server 4.1 | Affected |
| SUSE Manager Server 4.2 | Affected |
| openSUSE Leap 15.3 | Affected |
| openSUSE Leap 15.4 | Affected |
| openSUSE Leap 15.5 | Affected |
| openSUSE Leap 15.6 | Affected |
Share
External POC / Exploit Code
Leaving vuln.today