Infracost
Monthly
Infracost's template engine prior to v0.10.45 allows repository-controlled symlinks to escape the checkout directory, enabling any contributor with repository write access to read files accessible to the CI/CD runner. The vulnerable template functions - readFile, pathExists, isDir, and matchPaths in internal/config/template/parser.go - relied on lexical filepath.Abs normalization and leaf-only os.Lstat checks that failed to resolve intermediate directory symlinks, so a path like evil/secret passes validation while physically exiting the repository root. Captured file contents are rendered into Infracost configuration output and surfaced via the Infracost dashboard or pull request comments; no public exploit identified at time of analysis, and vendor-released patch is confirmed in v0.10.45.
Token exfiltration in Infracost prior to 0.10.45 allows an attacker who controls scanned Terraform source to redirect a configured Terraform Cloud or registry credential to an arbitrary attacker-controlled host. The vulnerable code path in internal/hcl/remote_variables_loader.go derived the destination hostname from untrusted Terraform cloud/backend block attributes without validating it against the operator-configured trusted host. CI pipelines using pull_request_target or same-repository pull request workflows that expose a TFC token to Infracost scans are affected; standard fork pull_request workflows without secrets are explicitly not vulnerable. No public exploit code has been identified at time of analysis, and this CVE is not listed in CISA KEV.
Infracost's template engine prior to v0.10.45 allows repository-controlled symlinks to escape the checkout directory, enabling any contributor with repository write access to read files accessible to the CI/CD runner. The vulnerable template functions - readFile, pathExists, isDir, and matchPaths in internal/config/template/parser.go - relied on lexical filepath.Abs normalization and leaf-only os.Lstat checks that failed to resolve intermediate directory symlinks, so a path like evil/secret passes validation while physically exiting the repository root. Captured file contents are rendered into Infracost configuration output and surfaced via the Infracost dashboard or pull request comments; no public exploit identified at time of analysis, and vendor-released patch is confirmed in v0.10.45.
Token exfiltration in Infracost prior to 0.10.45 allows an attacker who controls scanned Terraform source to redirect a configured Terraform Cloud or registry credential to an arbitrary attacker-controlled host. The vulnerable code path in internal/hcl/remote_variables_loader.go derived the destination hostname from untrusted Terraform cloud/backend block attributes without validating it against the operator-configured trusted host. CI pipelines using pull_request_target or same-repository pull request workflows that expose a TFC token to Infracost scans are affected; standard fork pull_request workflows without secrets are explicitly not vulnerable. No public exploit code has been identified at time of analysis, and this CVE is not listed in CISA KEV.