A vulnerability affecting the process of downloading and initializing external modules has been identified, carrying a CVSS v4 score of 6.9. This flaw permits unauthorized file deletion on the local filesystem during the module cleanup phase. By leveraging a maliciously crafted manifest file within a remote module, an attacker can manipulate the system into removing files outside the intended directory scope. This poses a significant risk to the integrity of deployment pipelines and local environments, potentially leading to widespread denial of service or critical configuration loss.
CVE-2026-45099: This vulnerability originates from improper input validation within the module manifest handling logic. When processing downloaded modules, the system trusts the manifest file without verifying path constraints, allowing for directory traversal. An attacker can supply a malicious manifest containing path specifications that point outside the secure module directory. Consequently, the automated cleanup routine executes deletions on arbitrary local files, impacting system stability and operational continuity during initialization tasks.[/subscribe_to_unlock_form]
A vulnerability affecting the process of downloading and initializing external modules has been identified, carrying a CVSS v4 score of 6.9. This flaw permits unauthorized file deletion on the local filesystem during the module cleanup phase. By leveraging a maliciously crafted manifest file within a remote module, an attacker can manipulate the system into removing files outside the intended directory scope. This poses a significant risk to the integrity of deployment pipelines and local environments, potentially leading to widespread denial of service or critical configuration loss.
CVE-2026-45099: This vulnerability originates from improper input validation within the module manifest handling logic. When processing downloaded modules, the system trusts the manifest file without verifying path constraints, allowing for directory traversal. An attacker can supply a malicious manifest containing path specifications that point outside the secure module directory. Consequently, the automated cleanup routine executes deletions on arbitrary local files, impacting system stability and operational continuity during initialization tasks.[emaillocker id="1283"]
Upgrading to the patched version is the only effective resolution. Until such updates are implemented, verify that all external module source URLs are restricted to trusted, internally vetted registries. Furthermore, ensure that module references are pinned to specific, immutable commit hashes rather than mutable tags or branches to prevent the injection of malicious manifest files.
We recommend you to update Terragrunt to version 1.0.4.
The following reports contain further technical details:
[/emaillocker]