{"id":"GO-2026-6871","summary":"OS command injection through PR-controlled Terraform workspace enables RCE during plan in github.com/runatlantis/atlantis","details":"OS command injection through PR-controlled Terraform workspace enables RCE during plan in github.com/runatlantis/atlantis","aliases":["CVE-2026-116676","GHSA-rjh2-4xgw-p2hj"],"modified":"2026-11-05T23:15:14.757125975Z","published":"2026-11-05T22:54:32Z","database_specific":{"url":"https://pkg.go.dev/vuln/GO-2026-6871","review_status":"REVIEWED"},"references":[{"type":"ADVISORY","url":"https://github.com/runatlantis/atlantis/security/advisories/GHSA-rjh2-4xgw-p2hj"},{"type":"FIX","url":"https://github.com/runatlantis/atlantis/commit/8dd22b4d0a9d7c129fdbf6a3398dd1c4cf8c3a59"},{"type":"FIX","url":"https://github.com/runatlantis/atlantis/commit/f04df0d53f0544d9eb6f5026dd8b74fbefd82ac8"},{"type":"FIX","url":"https://github.com/runatlantis/atlantis/pull/6792"},{"type":"WEB","url":"https://github.com/runatlantis/atlantis/releases/tag/v0.47.1"}],"affected":[{"package":{"name":"github.com/runatlantis/atlantis","ecosystem":"Go","purl":"pkg:golang/github.com/runatlantis/atlantis"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0.4.0"},{"fixed":"0.47.1"}]}],"ecosystem_specific":{"imports":[{"path":"github.com/runatlantis/atlantis/server/core/runtime/policy","symbols":["Arg.build","ConfTestExecutorWorkflow.Run","ConftestTestCommandArgs.build"]},{"symbols":["Project.Validate"],"path":"github.com/runatlantis/atlantis/server/core/config/raw"},{"path":"github.com/runatlantis/atlantis/server/controllers","symbols":["APIController.Apply","APIController.Plan","APIController.apiParseAndValidate"]},{"path":"github.com/runatlantis/atlantis/server/core/runtime","symbols":["ApplyStepRunner.Run","ApplyStepRunner.hasTargetFlag","EnvStepRunner.Run","InitStepRunner.Run","MultiEnvStepRunner.Run","RunStepRunner.Run","importStepRunner.Run","planStepRunner.Run","planStepRunner.buildPlanCmd","planStepRunner.remotePlan","planStepRunner.tfVars","stateRmStepRunner.Run","workspaceStepRunnerDelegate.Run"]},{"path":"github.com/runatlantis/atlantis/server/core/runtime/models","symbols":["LocalExec.CombinedOutput","ShellCommandRunner.Run","ShellCommandRunner.RunCommandAsync"]},{"path":"github.com/runatlantis/atlantis/server/core/terraform/tfclient","symbols":["DefaultClient.RunCommandAsync","DefaultClient.RunCommandWithVersion","DefaultClient.prepCmd","DefaultClient.prepExecCmd"]},{"path":"github.com/runatlantis/atlantis/server/events","symbols":["CommandScopedStatsProjectCommandContextBuilder.BuildProjectContext","CommentParser.Parse","DefaultProjectCommandBuilder.BuildApplyCommands","DefaultProjectCommandBuilder.BuildApprovePoliciesCommands","DefaultProjectCommandBuilder.BuildAutoplanCommands","DefaultProjectCommandBuilder.BuildImportCommands","DefaultProjectCommandBuilder.BuildPlanCommands","DefaultProjectCommandBuilder.BuildStateRmCommands","DefaultProjectCommandBuilder.BuildVersionCommands","DefaultProjectCommandContextBuilder.BuildProjectContext","DefaultProjectFinder.DetermineWorkspaceFromHCL","InstrumentedProjectCommandBuilder.BuildApplyCommands","InstrumentedProjectCommandBuilder.BuildAutoplanCommands","InstrumentedProjectCommandBuilder.BuildImportCommands","InstrumentedProjectCommandBuilder.BuildPlanCommands","InstrumentedProjectCommandBuilder.BuildStateRmCommands","PolicyCheckProjectCommandContextBuilder.BuildProjectContext","newProjectCommandContext"]}]},"database_specific":{"source":"https://vuln.go.dev/ID/GO-2026-6871.json"}}],"schema_version":"1.9.2"}