Atlantis: OS command injection through PR-controlled Terraform workspace enables RCE during plan
影響: go:github.com/runatlantis/atlantis >= 0.4.0, <= 0.47.0 → 0.47.1
Atlantis passes the Terraform workspace value from a pull request's atlantis.yaml into a shell command without quoting or escaping it. A contributor whose pull request is eligible for an Atlantis plan can include shell metacharacters in the workspace name and execute arbitrary commands as the Atlantis service account. This does not require custom workflows, allow_custom_workflows, or permission to run terraform apply. The executed command inherits the Atlantis process environment, which commonl…
| CVE | CVE-2026-116676 |
|---|---|
| 정보원 | GitHub Advisory Database |
| 수집 시각 | 2026. 10. 28. 오전 06:17 |
| 데이터 | Markdown JSON |
2026. 10. 28. 오전 06:04, GitHub Advisory Database에서 "Atlantis: OS command injection through PR-controlled Terraform workspace enables RCE during plan"을(를) 게시했습니다 (유형: 취약점 권고). 심각도는 "높음"(high)입니다. 관련 기술: Go, GitHub. CVE: CVE-2026-116676.