CVE-2026-14978 — Unicode normalization mismatch in go-slug ignore pattern matching may bypass intended file exclusions

CVE-2026-14978

Unicode normalization mismatch in go-slug ignore pattern matching may bypass intended file exclusions PUBLISHED

Description (CNA)

HashiCorp go-slug 0.4.0 through 0.18.2 could allow a local attacker to bypass .terraformignore exclusions and cause sensitive files to be included in Terraform slug uploads due to improper handling of Unicode normalization during path matching.

Affected (CNA)

Vendor / product	Versions
HashiCorp / go-slug	affected 0.4.0 through 0.18.2

CWE

CWE-176

References

https://www.ibm.com/support/pages/node/7284170

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.