CVE-2026-64672 with a CVSS score of 4.4 is a local symlink-following flaw in Terragrunt's catalog command, affecting Terragrunt versions below v1.1.1. When the command prepares a repository clone, it derives a deterministic temporary path under the shared system temporary directory from the repository URL. Because that path is predictable and the tool follows an existing symbolic link instead of rejecting it, a local attacker who can write to the shared temporary directory can plant a link before the victim runs the command. The attacker must be a separate local user or process on the same host and must know or infer the repository URL being cataloged. When the victim executes the catalog command, the tool follows the link, deletes an existing directory with the repository-derived leaf name under an attacker-chosen parent, and repopulates that path with cloned repository contents. This can cause unintended deletion and replacement of directories outside the intended temporary root, potentially disrupting workflows, corrupting local state, or exposing sensitive data on shared multi-user systems or shared CI runners. The impact is limited to local attack scenarios and does not require remote access.
We recommend you to update Terragrunt to version 1.1.1.[/subscribe_to_unlock_form]
CVE-2026-64672 with a CVSS score of 4.4 is a local symlink-following flaw in Terragrunt's catalog command, affecting Terragrunt versions below v1.1.1. When the command prepares a repository clone, it derives a deterministic temporary path under the shared system temporary directory from the repository URL. Because that path is predictable and the tool follows an existing symbolic link instead of rejecting it, a local attacker who can write to the shared temporary directory can plant a link before the victim runs the command. The attacker must be a separate local user or process on the same host and must know or infer the repository URL being cataloged. When the victim executes the catalog command, the tool follows the link, deletes an existing directory with the repository-derived leaf name under an attacker-chosen parent, and repopulates that path with cloned repository contents. This can cause unintended deletion and replacement of directories outside the intended temporary root, potentially disrupting workflows, corrupting local state, or exposing sensitive data on shared multi-user systems or shared CI runners. The impact is limited to local attack scenarios and does not require remote access.
We recommend you to update Terragrunt to version 1.1.1.[emaillocker id="1283"]
The following reports contain further technical details:
[/emaillocker]