{"affected":[{"product":"terragrunt","source":"CNA: GitHub_M","vendor":"gruntwork-io","versions":[{"status":"affected","version":"< 1.1.1"}]},{"defaultStatus":"unaffected","ecosystem":"Go","packageName":"github.com/gruntwork-io/terragrunt","product":"github.com/gruntwork-io/terragrunt","source":"OSV GHSA-wv6g-x823-wx9m","vendor":"","versions":[{"events":[{"introduced":"0"},{"fixed":"1.1.1"}],"lessThan":"1.1.1","status":"affected","version":"0","versionType":"semver"}]}],"cveId":"CVE-2026-64672","cwes":["CWE-59","CWE-377"],"description":"Terragrunt is a flexible orchestration tool that allows Infrastructure as Code written in OpenTofu or Terraform to scale. Prior to 1.1.1, the terragrunt catalog command derives a predictable per-repository catalog clone root under the shared system temporary directory and follows a symlink already placed at that path. A local attacker who can write to the temporary directory and predict the cataloged repository can redirect cleanup and cloning outside the intended root, causing an existing repository-named directory to be deleted and replaced in the victim's security context. The attack requires the victim to run terragrunt catalog on a shared host while the symlink is present, and it is not remotely exploitable. This issue is fixed in version 1.1.1.","epss":null,"exploits":[],"kev":null,"metrics":[{"score":4.4,"severity":"medium","source":"CNA: GitHub_M","vector":"CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:P/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N","version":"4.0"}],"modifiedAt":1793738644616,"publishedAt":1793738644616,"references":[{"source":"CNA: GitHub_M","tags":["x_refsource_CONFIRM"],"url":"https://github.com/gruntwork-io/terragrunt/security/advisories/GHSA-wv6g-x823-wx9m"},{"source":"CNA: GitHub_M","tags":["x_refsource_MISC"],"url":"https://github.com/gruntwork-io/terragrunt/pull/6438"},{"source":"CNA: GitHub_M","tags":["x_refsource_MISC"],"url":"https://github.com/gruntwork-io/terragrunt/commit/668891c5a2ad2996f134bb8b00098754674ea94a"},{"source":"CNA: GitHub_M","tags":["x_refsource_MISC"],"url":"https://github.com/gruntwork-io/terragrunt/releases/tag/v1.1.1"},{"source":"OSV / GitHub Security Advisories","tags":["advisory"],"url":"https://github.com/advisories/GHSA-wv6g-x823-wx9m"},{"source":"OSV / GitHub Security Advisories","tags":["osv"],"url":"https://osv.dev/vulnerability/GHSA-wv6g-x823-wx9m"}],"remediation":[{"kind":"fix","source":"OSV GHSA-wv6g-x823-wx9m","text":"github.com/gruntwork-io/terragrunt (Go): OSV reports a fixed version 1.1.1. Check the advisory for supported release branches.","url":"https://github.com/advisories/GHSA-wv6g-x823-wx9m"}],"revision":"68e837668abfc7c7007ff0600f95ff59f22822bf9f09aa733628ea39c11eda5c","sources":[{"modifiedAt":1793738644616,"name":"CNA: GitHub_M","retrievedAt":1793740933664,"url":"https://www.cve.org/CVERecord?id=CVE-2026-64672"},{"modifiedAt":1792446047510,"name":"OSV / GitHub Security Advisories","retrievedAt":1793740936897,"url":"https://osv.dev/vulnerability/GHSA-wv6g-x823-wx9m"}],"ssvc":null,"status":"published","title":"Terragrunt catalog predictable temp symlink clobber","updatedAt":1793740936897}