CVE-2026-14978: Unicode normalization mismatch in go-slug ignore pattern matching may bypass intended file exclusions
HashiCorp go-slug 0.4.0 through 0.18.2 could allow a local attacker to bypass .terraformignore exclusions and cause sensitive files to be included in Terraform slug uploads due to improper handling of Unicode normalization during path matching.
Other sources
HashiCorp go-slug could allow a local attacker to bypass .terraformignore exclusions and cause sensitive files to be included in Terraform slug uploads due to improper handling of Unicode normalization during path matching.
— IBM
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
github.com/hashicorp/go-slugto a version that resolves this vulnerability.Fixed in v0.18.3
Event History
Frequently Asked Questions
Who is realistically exposed to this issue?
Users of HashiCorp go-slug versions 0.4.0 through 0.18.2 are exposed when they rely on .terraformignore patterns to exclude sensitive files from Terraform slug uploads.
What does an attacker need to exploit the issue?
The issue is locally exploitable and requires user interaction. Exploitation involves using Unicode normalization differences in file paths so that intended .terraformignore exclusions do not match.
How can I tell whether a workflow may be affected?
Review whether .terraformignore is used to protect sensitive files and whether uploaded directories can contain file names with Unicode characters or differently normalized Unicode path forms. Such files may be included in slug uploads despite matching the intended exclusion semantically.