Vulnerability advisory
GO-2026-6871
OS command injection through PR-controlled Terraform workspace enables RCE during plan in github.com/runatlantis/atlantis
Also known as CVE-2026-116676GHSA-rjh2-4xgw-p2hj
Severity
Severity not reported.
Affected versions
| Affected | Fixed in |
|---|---|
0.4.0 to before 0.47.1 | 0.47.1 |
Description
OS command injection through PR-controlled Terraform workspace enables RCE during plan in github.com/runatlantis/atlantis
References
- Advisorygithub.com/runatlantis/atlantis/security/advisories/GHSA-rjh2-4xgw-p2hj ↗
- Fixgithub.com/runatlantis/atlantis/commit/8dd22b4d0a9d7c129fdbf6a3398dd1c4cf8c3a59 ↗
- Fixgithub.com/runatlantis/atlantis/commit/f04df0d53f0544d9eb6f5026dd8b74fbefd82ac8 ↗
- Fixgithub.com/runatlantis/atlantis/pull/6792 ↗
- Webgithub.com/runatlantis/atlantis/releases/tag/v0.47.1 ↗