Live › vulnerability › CVE-2026-64672
Go to dashboardTerragrunt's catalog feature creates a temporary symlink at a predictable path, so a local user on the same machine could pre-create that path and make Terragrunt overwrite or clobber a file of their choosing. The sources do not give the exact impact beyond that.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 19:13 UTC. All times on this page are UTC.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| github.com/gruntwork-io/terragrunt | go | < 1.1.1 | 1.1.1 |
Run terragrunt --version and check whether it is older than 1.1.1.
Upgrade github.com/gruntwork-io/terragrunt to 1.1.1 or later.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Terragrunt catalog predictable temp symlink clobber in github.com/gruntwork-io/terragrunt
This page as .md · .json · in your agent: get_signal("CVE-2026-64672")
Go Vulnerability Database, CC-BY 4.0. Posts quoted belong to their authors.