Description

HashiCorp go-slug 0.4.0 through 0.18.2 could allow a local attacker to bypass .terraformignore exclusions and cause sensitive files to be included in Terraform slug uploads due to improper handling of Unicode normalization during path matching.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.5",
  "pubDate": "2026-08-19T21:16:54.007Z",
  "pubdate": "2026-08-19T21:16:54.007Z",
  "executiveSummary": "A path matching vulnerability exists in HashiCorp go-slug versions 0.4.0 through 0.18.2, which allows a local attacker to bypass .terraformignore exclusions and force the inclusion of sensitive files within Terraform slug archives.\nThe flaw stems from improper handling of Unicode normalization during path evaluation and pattern matching against exclusion rules defined in ignore files.\nBy crafting file paths with specific Unicode character variations that fail to normalize correctly, an attacker can evade intended exclusion mechanisms.\nThis vulnerability compromises the confidentiality of local files, potentially exposing sensitive data, credentials, or proprietary configurations that were explicitly intended to be omitted from uploads.\nExploitation requires local access to the system where the slug generation is performed, allowing the manipulation of file paths and directory structures prior to archive creation.\nNo network exposure is inherently required for the underlying path mismatch to trigger, as the core issue lies in the internal string processing logic of the affected go-slug library during local archive packaging.",
  "technicalDetails": "The root cause of the vulnerability resides within the path matching and exclusion evaluation logic of the HashiCorp go-slug library, specifically in how string comparisons are executed against patterns defined in .terraformignore files.\nDuring the packaging of files into a slug archive, the library iterates over local directory contents and evaluates file paths against ignore rules to determine which artifacts should be omitted.\nDue to improper handling or complete omission of proper Unicode normalization (such as Form C or Form D normalization) during path string processing, file paths containing alternate Unicode representations fail to match equivalent exclusion patterns.\nAn attacker with local file system access can create files or directories utilizing alternative Unicode character sequences that logically represent targeted sensitive files but differ in their underlying byte representation from the exclusion patterns listed in .terraformignore.\nWhen the go-slug library processes these paths, the mismatch causes the exclusion filter to incorrectly evaluate the path as safe for inclusion.\nConsequently, the sensitive files are packaged into the resulting Terraform slug upload, bypassing the security boundary enforced by the ignore file.\nThe vulnerable component is the path matching and filtering subsystem of the HashiCorp go-slug library, affecting all versions from 0.4.0 up to and including 0.18.2.\nPrivilege requirements are minimal, requiring only local file creation capabilities within the targeted directory structure.\nPost-exploitation impact involves the unauthorized disclosure of sensitive information contained within the improperly included files, which are subsequently transmitted to remote systems via the Terraform slug upload mechanism."
}