Atlantis: OS command injection through PR-controlled Terraform workspace enables RCE during plan
影響: go:github.com/runatlantis/atlantis >= 0.4.0, <= 0.47.0 → 0.47.1
Atlantis passes the Terraform workspace value from a pull request's atlantis.yaml into a shell command without quoting or escaping it. A contributor whose pull request is eligible for an Atlantis plan can include shell metacharacters in the workspace name and execute arbitrary commands as the Atlantis service account. This does not require custom workflows, allow_custom_workflows, or permission to run terraform apply. The executed command inherits the Atlantis process environment, which commonl…
Read on GitHub Advisory Database
| CVE | CVE-2026-116676 |
|---|---|
| Source | GitHub Advisory Database |
| Fetched | 10/28/2026, 06:17 AM |
| Data | Markdown JSON |
On 10/28/2026, 06:04 AM, GitHub Advisory Database published "Atlantis: OS command injection through PR-controlled Terraform workspace enables RCE during plan" (type: Advisory). Severity is "High" (high). Related technologies: Go, GitHub. CVE: CVE-2026-116676.