Threats tagged 'ghsa-rjh2-4xgw-p2hj'

Atlantis contains an OS command injection vulnerability in its handling of the Terraform workspace name specified in a pull request's atlantis.yaml file. The workspace name is passed into a shell command without proper escaping, allowing an attacker controlling a pull request to execute arbitrary shell commands as the Atlantis service account during the plan phase. This does not require custom workflows or apply permissions. The vulnerability affects versions from 0.4.0 up to but not including 0.47.1 and has been fixed in version 0.47.1.