CVE-2026-14978— Unicode normalization mismatch in go-slug ignore pattern matching may bypass intended file exclusions
Quick assessment
Affected
HashiCorp go-slug
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
HashiCorp 的 go-slug 版本 0.4.0 至 0.18.2 中存在一个安全漏洞，可能导致本地攻击者绕过 .terraformignore 排除规则，使得敏感文件被意外包含在 Terraform 的 slug 上传内容中。该漏洞源于路径匹配过程中对 Unicode 规范化处理不当。
Possible ATT&CK Techniques 1 AI
T1530 · Data from Cloud Storage
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-14978
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Unicode normalization mismatch in go-slug ignore pattern matching may bypass intended file exclusions
Source: CVE Program / CVE List V5
Vulnerability Description
HashiCorp go-slug 0.4.0 through 0.18.2 could allow a local attacker to bypass .terraformignore exclusions and cause sensitive files to be included in Terraform slug uploads due to improper handling of Unicode normalization during path matching.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
Unicode编码处理不恰当
Source: CVE Program / CVE List V5
Affected Products
II. Public POCs for CVE-2026-14978
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-14978
请登录查看更多情报信息。
Other References for CVE-2026-14978 (1)
IV. Related Vulnerabilities
Same vendor: HashiCorp
-
CVE-2026-5006
Vault Vulnerable to Privilege Escalation via Slash Injection -
CVE-2026-19589
Packer vulnerable to arbitrary file write via crafted plugin -
CVE-2026-8715
Vault Secrets Operator vulnerable to arbitrary file read and -
CVE-2026-14886
Vault Enterprise vulnerable to cross-namespace entity deleti -
CVE-2026-12624
Vault vulnerable to LIST authorization bypass via trailing-s
Same weakness: CWE-176
-
CVE-2026-59890
setuptools: MANIFEST.in exclusion bypass in sdist via Unicod -
CVE-2026-48618
nodejs Node.js 输入验证错误漏洞 -
CVE-2025-71316
SQLite sqldiff remote code execution via argument injection -
CVE-2026-44288
protobufjs: Overlong UTF-8 decoding -
CVE-2026-7040
Text::Minify::XS versions from 0.3.0 before 0.7.8 for Perl h
V. Comments for CVE-2026-14978
No comments yet