EUVD-2026-358660

fkie_cve-2026-45099

Terragrunt is a flexible orchestration tool that allows Infrastructure as Code written in OpenTofu or Terraform to scale. Prior to 1.0.4, Terragrunt trusts paths decoded from a downloaded module's .terragrunt-module-manifest during fileManifest.Clean() in internal/util/file.go. A malicious or compromised external module can place absolute or traversal paths in the manifest, causing cleanup to delete files outside the module cache that are accessible to the Terragrunt process before OpenTofu or Terraform executes. This deletion-only primitive can remove local source code or configuration and disrupt CI/CD pipelines. This issue is fixed in version 1.0.4.

GHSA-8394-6f8r-whxg — Terragrunt: Arbitrary File Deletion via Malicious Module Manifest

Affected: Go: github.com/gruntwork-io/terragrunt

### Summary

Terragrunt is vulnerable to an arbitrary file deletion flaw when downloading external modules. If a remote module contains a maliciously crafted `.terragrunt-module-manifest` file, Terragrunt can be tricked into deleting files anywhere on the local filesystem that the Terragrunt process has access to.

### Impact

This vulnerability impacts users who download and run untrusted or compromised OpenTofu/Terraform modules. The file deletion occurs during the module download and initialization phase, meaning it happens before OpenTofu or Terraform executes.

In a CI/CD environment or automated runner, an attacker-controlled module could delete arbitrary files, causing denial of service in the deployment pipeline. In a local environment, it could lead to the loss of local source code or configuration files.

This vulnerability is a deletion-only primitive; it does not directly allow for arbitrary code execution (RCE) or data exfiltration.

### Affected Versions

- Terragrunt < `v1.0.4`

### Patches

This vulnerability has been resolved in Terragrunt version `v1.0.4`.

All users are strongly advised to upgrade.

### Workarounds

If users cannot upgrade immediately, they can mitigate this risk by:

1. Strictly auditing the source URLs of all remote modules used in their Terragrunt configurations. 2. Only consuming modules from trusted, internally vetted sources or verified registries. 3. Pinning module versions to specific, known-safe Git commit SHAs rather than mutabl…

Most recent entries from all

EUVD-2026-358660

fkie_cve-2026-45099

GHSA-8394-6f8r-whxg — Terragrunt: Arbitrary File Deletion via Malicious Module Manifest