HashiCorp go-slug 0.4.00.18.2 Unicode Normalization .terraformignore Bypass
CVE-2026-14978 Published on August 19, 2026

Unicode normalization mismatch in go-slug ignore pattern matching may bypass intended file exclusions
HashiCorp go-slug 0.4.0 through 0.18.2 could allow a local attacker to bypass .terraformignore exclusions and cause sensitive files to be included in Terraform slug uploads due to improper handling of Unicode normalization during path matching.

Vendor Advisory NVD

Vulnerability Analysis

CVE-2026-14978 is exploitable with local system access, requires user interaction. This vulnerability is considered to have a low attack complexity. The potential impact of an exploit of this vulnerability is considered to have a high impact on confidentiality, with no impact on integrity and availability.

Attack Vector:
LOCAL
Attack Complexity:
LOW
Privileges Required:
NONE
User Interaction:
REQUIRED
Scope:
UNCHANGED
Confidentiality Impact:
HIGH
Integrity Impact:
NONE
Availability Impact:
NONE

Weakness Type

Improper Handling of Unicode Encoding

The software does not properly handle when an input contains Unicode encoding.


Products Associated with CVE-2026-14978

Want to know whenever a new CVE is published for HashiCorp Go Slug? stack.watch will email you.

HashiCorp Go Slug
 

Affected Versions

HashiCorp go-slug: