CVE-2026-14978

HashiCorp go-slug 0.4.0 through 0.18.2 could allow a local attacker to bypass .terraformignore exclusions and cause sensitive files to be included in Terraform slug uploads due to improper handling of Unicode normalization during path matching.

Scoring

Severity

MEDIUM

CVSS base score

5.5

CVSS vector

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

EPSS probability

0.10%

CWE

CWE-176

Published

2026-08-19

Last modified

2026-08-20

Affected products

• HashiCorp go-slug

Weakness type

• CWE-176

Related vulnerabilities

• CVE-2026-59890 — setuptools: MANIFEST.in exclusion bypass in sdist via Unicode normalization collision (NFC/NFD) on macOS APFS/HFS+
• CVE-2026-48618 — A flaw in Node.js TLS hostname handling can cause Node.js unicode dot separator handling can lead...
• CVE-2026-45135 — Caddy: Unsafe Unicode Handling in FastCGI splitPos Allows Execution of Non-PHP Files
• CVE-2026-49401 — Deno Permission Bypass via Unicode Normalization Mismatch on macOS (APFS)
• CVE-2026-45062 — FrankenPHP: Unsafe Unicode Handling in CGI Path Splitting Allows Execution of Non-PHP Files
• CVE-2025-71316 — SQLite sqldiff remote code execution via argument injection
• CVE-2026-44288 — protobufjs: Overlong UTF-8 decoding
• CVE-2026-7040 — Text::Minify::XS versions from 0.3.0 before 0.7.8 for Perl have heap overflow when processing some malformed UTF-8 characters

Markdown version · Browse all CVEs