Atlantis: OS command injection through PR-controlled Terraform workspace enables RCE during plan

影響: go:github.com/runatlantis/atlantis >= 0.4.0, <= 0.47.0 → 0.47.1

Atlantis passes the Terraform workspace value from a pull request's atlantis.yaml into a shell command without quoting or escaping it. A contributor whose pull request is eligible for an Atlantis plan can include shell metacharacters in the workspace name and execute arbitrary commands as the Atlantis service account. This does not require custom workflows, allow_custom_workflows, or permission to run terraform apply. The executed command inherits the Atlantis process environment, which commonl…

在 GitHub Advisory Database 阅读

2026/10/28 06:04，GitHub Advisory Database 发布了“Atlantis: OS command injection through PR-controlled Terraform workspace enables RCE during plan”（类型：漏洞公告）。严重程度为“高危”（high）。相关技术：Go、GitHub。CVE：CVE-2026-116676。