Threats affecting pkg:github/gruntwork-io/terragrunt

CVE-2026-64672 is a vulnerability in terragrunt versions prior to 1.1.1 where the catalog command follows a symlink in a predictable temporary directory. A local attacker with write access to the temporary directory can redirect operations to delete and replace directories outside the intended root, but exploitation requires local access and user interaction. This issue is fixed in version 1.1.1.