Terragrunt versions before 1.0.4 improperly limit pathnames during the cleanup of downloaded module manifests. Specifically, the fileManifest.Clean() function in internal/util/file.go trusts paths from the .terragrunt-module-manifest without sufficient validation. This allows an attacker controlling a module to specify absolute or traversal paths that cause deletion of files outside the module cache accessible to the Terragrunt process. The vulnerability is a deletion-only primitive, meaning it cannot modify or create files but can remove critical local files, impacting local source code or configuration and disrupting automated pipelines. The issue is resolved in Terragrunt version 1.0.4.

An attacker who can supply or compromise an external module can cause Terragrunt to delete arbitrary files accessible to its process on the local filesystem. This can lead to loss of local source code or configuration files and disrupt continuous integration and deployment workflows. There is no indication of remote code execution or privilege escalation. The impact is limited to file deletion within the permissions of the Terragrunt process.

Upgrade Terragrunt to version 1.0.4 or later, where this path traversal and unauthorized file deletion vulnerability is fixed. No other mitigations are indicated or required.