CVE Catalog
CVE-2026-14978
MediumCVSS 5.5Summary
HashiCorp go-slug 0.4.0 through 0.18.2 could allow a local attacker to bypass .terraformignore exclusions and cause sensitive files to be included in Terraform slug uploads due to improper handling of Unicode normalization during path matching.
Risk Assessment
Potential accidental or intentional disclosure of sensitive files during Terraform slug uploads, potentially leading to data leakage.
Recommendation
Update the go-slug library to the latest patched version and review .terraformignore configurations for potential gaps.
Original NVD description (English source)
HashiCorp go-slug 0.4.0 through 0.18.2 could allow a local attacker to bypass .terraformignore exclusions and cause sensitive files to be included in Terraform slug uploads due to improper handling of Unicode normalization during path matching.