CVE-2026-71493 in Infracost
Summary
by MITRE • 08/21/2026
Infracost provides cloud cost intelligence for engineers, AI coding agents, and CI/CD. Prior to 0.10.45, the readFile, pathExists, isDir, and matchPaths template functions in internal/config/template/parser.go use a lexical filepath.Rel check and a leaf-only os.Lstat check that do not resolve an intermediate directory symlink. A repository can contain a path such as evil/file where evil points outside the checkout, causing os.ReadFile and related operations to follow the symlink and read runner-accessible files. The resulting content is rendered into generated configuration and can be surfaced through the Infracost dashboard or pull request comment, with greater impact in workflows that provide repository secrets. This issue is fixed in version 0.10.45.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 08/21/2026
The vulnerability identified within Infracost versions prior to 0.10.45 represents a significant path traversal and information disclosure flaw rooted in the implementation of template parsing functions. Specifically, the internal configuration parser utilizes lexical checks via filepath.Rel combined with leaf-only directory status verification using os.Lstat to validate file paths before reading them. This approach fails to resolve intermediate symbolic links that may exist within the repository structure. Consequently, an attacker or a maliciously crafted repository can construct a path where an intermediate component is a symlink pointing outside the intended checkout directory. When functions such as readFile, pathExists, isDir, and matchPaths process these paths, they follow the symlink without detecting that it leads to unauthorized locations on the filesystem. This allows the application to read files accessible by the runner executing the Infracost command, effectively bypassing the sandboxed environment expected in CI/CD pipelines or local development workflows.
The operational impact of this vulnerability is severe due to the nature of how Infracost processes and displays data. The content retrieved from these unauthorized file reads is rendered directly into generated configuration outputs. These outputs are frequently surfaced through user-facing interfaces such as the Infracost dashboard or comments posted on pull requests in version control systems like GitHub or GitLab. This mechanism transforms a local filesystem read error into a potential remote information disclosure vector. If an attacker can influence the repository structure, they can cause sensitive files to be embedded in these public or semi-public outputs. The risk is amplified significantly in workflows that handle repository secrets, as the exposure of configuration data containing secret values could lead to credential compromise and further lateral movement within the infrastructure being managed by Infracost.
From a security classification perspective, this vulnerability aligns with CWE-22: Improper Limitation of a Pathname to a Restricted Directory, commonly known as path traversal. The failure to canonicalize paths or resolve symlinks before validation is a classic implementation error that allows access outside the designated root directory. Furthermore, because the exploit involves reading arbitrary files from the host system and potentially exfiltrating data through application outputs, it also relates to CWE-200: Exposure of Sensitive Information to an Unauthorized Actor. In terms of offensive security frameworks, this behavior is consistent with ATT&CK technique T1552.004: Unsecured Credentials, specifically when secrets are exposed via configuration files, and potentially T1083: File and Directory Discovery if the goal is reconnaissance within the runner environment. The vulnerability highlights the critical importance of using canonical path resolution rather than lexical string manipulation for security-critical file access decisions in Go applications.
To mitigate this risk, organizations must upgrade to Infracost version 0.10.45 or later, where the parsing logic has been corrected to properly resolve intermediate symlinks and enforce strict directory boundaries. For environments that cannot immediately update, it is advisable to audit CI/CD pipelines for repositories containing symbolic links in their source code structures. Additionally, implementing stricter input validation on repository contents before they are processed by Infracost can provide a layer of defense. Security teams should also review the output formats generated by older versions of the tool to ensure that no sensitive data was inadvertently exposed through dashboard views or pull request comments during the period when vulnerable versions were in use. Regular scanning for path traversal vulnerabilities and enforcing canonicalization checks on all file system interactions are essential practices to prevent similar issues in future software development cycles.