Skip to content
OpenAdvisories

Product · HashiCorp

go-slug

1 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

1 result · Clear filters · Feed

  • Medium 5.5
    CVE-2026-14978

    Unicode normalization mismatch in go-slug ignore pattern matching may bypass intended file exclusions

    HashiCorp go-slug 0.4.0 through 0.18.2 could allow a local attacker to bypass .terraformignore exclusions and cause sensitive files to be included in Terraform slug uploads due to improper handling of Unicode normalization during path matching.

    HashiCorp go-slug terraform opentofu-1.9 Wolfi