CVE-2026-14978 PUBLISHED

Unicode normalization mismatch in go-slug ignore pattern matching may bypass intended file exclusions

Assigner: ibm
Reserved: 07.07.2026 Published: 19.08.2026 Updated: 19.08.2026

HashiCorp go-slug 0.4.0 through 0.18.2 could allow a local attacker to bypass .terraformignore exclusions and cause sensitive files to be included in Terraform slug uploads due to improper handling of Unicode normalization during path matching.

Metrics

CVSS 3.1

CVSS Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
CVSS Score: 5.5

Attack Vector	Local	Scope	Unchanged
Attack Complexity	Low	Confidentiality Impact	High
Privileges Required	None	Integrity Impact	None
User Interaction	Required	Availability Impact	None

CVSS 3.1

Product Status

Vendor	HashiCorp
Product	go-slug
Versions	affected from 0.4.0 to 0.18.2 (incl.)

Solutions

Customers should evaluate the risk associated with this issue and consider upgrading to github.com/hashicorp/go-slug v0.18.3.

Credits

Tomas Illuminati (https://github.com/tomasilluminati) finder

References

https://www.ibm.com/support/pages/node/7284170

Problem Types

CWE-176 Improper Handling of Unicode Encoding CWE