CVE-2026-71493: Infracost: Arbitrary file read via config-template readFile symlink traversal
Infracost provides cloud cost intelligence for engineers, AI coding agents, and CI/CD. Prior to 0.10.45, the readFile, pathExists, isDir, and matchPaths template functions in internal/config/template/parser.go use a lexical filepath.Rel check and a leaf-only os.Lstat check that do not resolve an intermediate directory symlink. A repository can contain a path such as evil/file where evil points outside the checkout, causing os.ReadFile and related operations to follow the symlink and read runner-accessible files. The resulting content is rendered into generated configuration and can be surfaced through the Infracost dashboard or pull request comment, with greater impact in workflows that provide repository secrets. This issue is fixed in version 0.10.45.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Infracostto a version that resolves this vulnerability.Fixed in 0.10.45
Event History
Frequently Asked Questions
Which environments are realistically exposed?
Workflows that process a repository containing attacker-controlled configuration templates are exposed when they run an Infracost version earlier than 0.10.45. CI/CD runners are particularly sensitive because the vulnerable functions can read files accessible to the runner; impact is greater where repository secrets are available to the workflow.
What must an attacker provide to exploit this issue?
The attacker needs to cause a configuration template to use readFile, pathExists, isDir, or matchPaths on a path traversing an intermediate directory symlink. For example, a repository path can contain a directory symlink that points outside the checkout, allowing the operation to follow it.
How can exposed file contents be disclosed?
Content read through the symlink can be rendered into generated configuration. It may then be surfaced in the Infracost dashboard or in a pull request comment.
What should teams do if they cannot immediately upgrade?
Avoid running affected template functions against paths that can include repository-controlled symlinks, and restrict untrusted repositories or pull requests from accessing workflows with runner-accessible secrets. Upgrade to version 0.10.45 when possible.