{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-64672","assignerOrgId":"a0819718-46f1-4df5-94e2-005712e83aaa","state":"PUBLISHED","assignerShortName":"GitHub_M","dateReserved":"2026-07-20T17:12:12.891Z","datePublished":"2026-11-03T20:44:04.616Z","dateUpdated":"2026-11-03T20:44:04.616Z"},"containers":{"cna":{"title":"Terragrunt catalog predictable temp symlink clobber","problemTypes":[{"descriptions":[{"cweId":"CWE-59","lang":"en","description":"CWE-59: Improper Link Resolution Before File Access ('Link Following')","type":"CWE"}]},{"descriptions":[{"cweId":"CWE-377","lang":"en","description":"CWE-377: Insecure Temporary File","type":"CWE"}]}],"metrics":[{"cvssV4_0":{"attackVector":"LOCAL","attackComplexity":"LOW","attackRequirements":"PRESENT","privilegesRequired":"LOW","userInteraction":"PASSIVE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"HIGH","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","baseScore":4.4,"baseSeverity":"MEDIUM","vectorString":"CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:P/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N","version":"4.0"}}],"references":[{"name":"https://github.com/gruntwork-io/terragrunt/security/advisories/GHSA-wv6g-x823-wx9m","tags":["x_refsource_CONFIRM"],"url":"https://github.com/gruntwork-io/terragrunt/security/advisories/GHSA-wv6g-x823-wx9m"},{"name":"https://github.com/gruntwork-io/terragrunt/pull/6438","tags":["x_refsource_MISC"],"url":"https://github.com/gruntwork-io/terragrunt/pull/6438"},{"name":"https://github.com/gruntwork-io/terragrunt/commit/668891c5a2ad2996f134bb8b00098754674ea94a","tags":["x_refsource_MISC"],"url":"https://github.com/gruntwork-io/terragrunt/commit/668891c5a2ad2996f134bb8b00098754674ea94a"},{"name":"https://github.com/gruntwork-io/terragrunt/releases/tag/v1.1.1","tags":["x_refsource_MISC"],"url":"https://github.com/gruntwork-io/terragrunt/releases/tag/v1.1.1"}],"affected":[{"vendor":"gruntwork-io","product":"terragrunt","versions":[{"version":"< 1.1.1","status":"affected"}]}],"providerMetadata":{"orgId":"a0819718-46f1-4df5-94e2-005712e83aaa","shortName":"GitHub_M","dateUpdated":"2026-11-03T20:44:04.616Z"},"descriptions":[{"lang":"en","value":"Terragrunt is a flexible orchestration tool that allows Infrastructure as Code written in OpenTofu or Terraform to scale. Prior to 1.1.1, the terragrunt catalog command derives a predictable per-repository catalog clone root under the shared system temporary directory and follows a symlink already placed at that path. A local attacker who can write to the temporary directory and predict the cataloged repository can redirect cleanup and cloning outside the intended root, causing an existing repository-named directory to be deleted and replaced in the victim's security context. The attack requires the victim to run terragrunt catalog on a shared host while the symlink is present, and it is not remotely exploitable. This issue is fixed in version 1.1.1."}],"source":{"advisory":"GHSA-wv6g-x823-wx9m","discovery":"UNKNOWN"}}}}