MEDIUM GitHub
CVE-2026-64672
Terragrunt catalog predictable temp symlink clobber
### Summary
Terragrunt's `terragrunt catalog` command clones each repository referenced in your catalog configuration into a temporary working directory. In affected versions, the clone path it derived was deterministic and sat under the shared system temporary directory, in the form `<tmp>/catalog-<base64 sha1 of the repo URL>`. Because that path was predictable and Terragrunt followed a symlink already present there instead of rejecting it, a local attacker could plant a symlink at that path
Affected Products
- go/github.com/gruntwork-io/terragrunt < 1.1.1
References
- https://github.com/advisories/GHSA-wv6g-x823-wx9m
- https://github.com/gruntwork-io/terragrunt/security/advisories/GHSA-wv6g-x823-wx9m
- https://github.com/gruntwork-io/terragrunt/pull/6438
- https://github.com/gruntwork-io/terragrunt/commit/668891c5a2ad2996f134bb8b00098754674ea94a
This medium severity vulnerability was published on 2026-10-15 via GitHub. Affected: go/github.com/gruntwork-io/terragrunt < 1.1.1.
vulnfeed aggregates 14677 vulnerabilities from NVD, CISA KEV,
Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.