CVE-2026-45099

Name of the Vulnerable Software and Affected Versions Terragrunt versions prior to 1.0.4

Description Terragrunt contains a flaw that allows arbitrary file deletion when downloading external modules. The issue occurs during the directory cleanup process within the fileManifest.Clean() function located in internal/util/file.go. Terragrunt trusts paths decoded from a downloaded module's .terragrunt-module-manifest without verifying that they remain within the module's destination directory. A malicious or compromised external module can include absolute or directory traversal paths in the manifest, enabling the deletion of files outside the module cache that are accessible to the Terragrunt process. This occurs before OpenTofu or Terraform executes and can be used to remove local source code or configuration, potentially disrupting CI/CD pipelines.

Recommendations Update to version 1.0.4. Strictly audit the source URLs of all remote modules used in configurations. Consume modules only from trusted, internally vetted sources or verified registries. Pin module versions to specific, known-safe Git commit SHAs instead of mutable tags or branches.