CVE-2026-14978 — Unicode normalization mismatch in go-slug ignore pattern matching may bypass intended file exclusions
HashiCorp go-slug 0.4.0 through 0.18.2 could allow a local attacker to bypass .terraformignore exclusions and cause sensitive files to be included in Terraform slug uploads due …
Published: 2026-08-19 · CVSS: 5.5 · CVSS 3.1
HashiCorp go-slug 0.4.0 through 0.18.2 could allow a local attacker to bypass .terraformignore exclusions and cause sensitive files to be included in Terraform slug uploads due to improper handling of Unicode normalization during path matching.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7