CVE-2026-14978
MEDIUM
NVD
CVSS Score
5.5
Severity
MEDIUM
Published
Aug 19, 2026
Vendor
unknown
Description
HashiCorp go-slug 0.4.0 through 0.18.2 could allow a local attacker to bypass .terraformignore exclusions and cause sensitive files to be included in Terraform slug uploads due to improper handling of Unicode normalization during path matching.