CVE Feed

    Dashboard / CVE / CVE-2026-14978

    CVE-2026-14978

    HashiCorp go-slug 0.4.0 through 0.18.2 could allow a local attacker to bypass .terraformignore exclusions and cause sensitive files to be included in Terraform slug uploads due to improper handling of Unicode normalization during path matching.

    Published:Aug 19, 2026
    Last Modified:Sep 4, 2026
    EPS:Aug 19, 2026
    EPSS Score:0.00121
    CVSS Score:5.5

    Affected Products

    Vendor
    Hashicorp
    Product
    Go-slug
    Vendor
    Hashicorp
    Product
    Go Slug

    Exploits

    No exploit reference

    Common Attack Pattern Enumeration and Classification (CAPEC)

    CAPEC-71 Using Unicode Encoding to Bypass Validation Logic

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High