Skip to content
OpenAdvisories

Package · Go

github.com/infracost/infracost

2 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

2 results · Feed

  • Medium 5.9
    CVE-2026-71493

    Infracost: Arbitrary file read via config-template readFile symlink traversal

    Infracost provides cloud cost intelligence for engineers, AI coding agents, and CI/CD. Prior to 0.10.45, the readFile, pathExists, isDir, and matchPaths template functions in internal/config/template/parser.go use a lexical filepath.Rel check and a leaf-only …

    infracost infracost github.com/infracost/infracost Go
  • Medium 5.9
    CVE-2026-71494

    Infracost: Terraform Cloud and registry token disclosure via unvalidated hostname

    Infracost provides cloud cost intelligence for engineers, AI coding agents, and CI/CD. Prior to 0.10.45, internal/hcl/remote_variables_loader.go and related Terraform Cloud, remote-plan, and Terragrunt registry request paths can attach a configured Terraform …

    infracost infracost github.com/infracost/infracost Go