Skip to content
OpenAdvisories

Package · Go

github.com/runatlantis/atlantis

5 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

4 results · Clear filters · Feed

  • High 8.8
    CVE-2026-116676

    Atlantis: OS command injection through PR-controlled Terraform workspace enables RCE during plan

    Atlantis is a self-hosted golang application that listens for Terraform pull request events via webhooks. From version 0.4.0 until 0.47.1, Atlantis passes the pull-request-controlled workspace value from atlantis.yaml into Terraform command arguments that are…

    runatlantis atlantis github.com/runatlantis/atlantis Go
  • High 8.1
    CVE-2026-64679

    Atlantis: Path Traversal in Atlantis Workspace Handling Allows Out-of-Bounds Directory Deletion/Creation

    Atlantis is a self-hosted golang application that listens for Terraform pull request events via webhooks. From 0.19.8 until 0.45.0, Atlantis does not consistently validate user-controlled workspace values supplied through accepted repository-level atlantis.ya…

    runatlantis atlantis github.com/runatlantis/atlantis Go
  • High 8.5
    CVE-2024-52009

    Git credentials are exposed in atlantis logs

    Atlantis is a self-hosted golang application that listens for Terraform pull request events via webhooks. Atlantis logs contains GitHub credentials (tokens `ghs_...`) when they are rotated. This enables an attacker able to read these logs to impersonate Atlan…

    runatlantis atlantis github.com/runatlantis/atlantis Go
  • High 7.5
    CVE-2022-24912

    Timing Attack

    The package github.com/runatlantis/atlantis/server/controllers/events before 0.19.7 are vulnerable to Timing Attack in the webhook event validator code, which does not use a constant-time comparison function to validate the webhook secret. It can allow an att…

    github.com/runatlantis/atlantis Go