CVE-2026-14978
Medium · 5.5CVSS
5.5
EPSS
0.1%
Published
Aug 19, 2026
CISA due date
—
The record
HashiCorp go-slug 0.4.0 through 0.18.2 could allow a local attacker to bypass .terraformignore exclusions and cause sensitive files to be included in Terraform slug uploads due to improper handling of Unicode normalization during path matching.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|
Related vulnerabilities
- CVE-2026-93990 Expat before 2.8.5 fails to validate that a high surrogate in UTF-16 input is followed by… CWE-176
- CVE-2026-93751 uri-js through 4.4.1 contains an improper UTF-8 decoding vulnerability in pctDecChars()… CWE-176
- CVE-2026-81869 OpenTelemetry-Go is the Go implementation of OpenTelemetry. CWE-176
- CVE-2026-59890 setuptools is a package that allows users to download, build, install, upgrade, and… CWE-176
- CVE-2026-48618 A flaw in Node.js TLS hostname handling can cause Node.js unicode dot separator handling… CWE-176
- CVE-2026-49401 Deno is a JavaScript, TypeScript, and WebAssembly runtime. CWE-176
- CVE-2026-45135 Caddy is an extensible server platform that uses TLS by default. CWE-176
- GHSA-8xpq-cjcf-3wh9 Deno: Permission Bypass via Unicode Normalization Mismatch on macOS (APFS) CWE-176