CVE-2026-64672

Name of the Vulnerable Software and Affected Versions Terragrunt versions prior to 1.1.1

Description The terragrunt catalog command clones repositories into a temporary directory using a deterministic path based on a base64 sha1 hash of the repository URL. A local attacker with write access to the shared system temporary directory can predict this path and place a symlink there. When the command is executed, Terragrunt follows the symlink, allowing the attacker to cause the deletion of a directory and the re-cloning of repository contents into an arbitrary location outside the intended temporary root. This issue affects users on multi-user servers or shared CI runners where untrusted local users or processes are present.

Recommendations Update to Terragrunt version 1.1.1. Ensure that untrusted parties cannot control the values of TMPDIR, TMP, and TEMP environment variables in environments where terragrunt catalog is executed.