Atlantis: OS command injection through PR-controlled Terraform workspace enables RCE during plan

影響: go:github.com/runatlantis/atlantis >= 0.4.0, <= 0.47.0 → 0.47.1

Atlantis passes the Terraform workspace value from a pull request's atlantis.yaml into a shell command without quoting or escaping it. A contributor whose pull request is eligible for an Atlantis plan can include shell metacharacters in the workspace name and execute arbitrary commands as the Atlantis service account. This does not require custom workflows, allow_custom_workflows, or permission to run terraform apply. The executed command inherits the Atlantis process environment, which commonl…

GitHub Advisory Databaseで読む

2026/10/28 06:04、GitHub Advisory Databaseが「Atlantis: OS command injection through PR-controlled Terraform workspace enables RCE during plan」を公開しました (種別: 脆弱性アドバイザリ)。重大度は「重要」(high) です。関連する技術: Go、GitHub。CVE: CVE-2026-116676。