CVE-2026-64672: github.com/gruntwork-io/terragrunt < 1.1.1

Affected technology

github.com/gruntwork-io/terragrunt · < 1.1.1
Vendor not specified by the source

Component: Not specified by the source

What an attacker can do

A local attacker could plant a symlink at that path and cause Terragrunt to delete a directory and re-clone into it outside the intended temporary root. ### Impact This affected users who ran `terragrunt catalog` on a host they shared with other local users or processes they did not fully trust, such as a multi-user server or a shared CI runner.