CVE-2026-71493

Name of the Vulnerable Software and Affected Versions Infracost versions prior to 0.10.45

Description Template functions readFile(), pathExists(), isDir(), and matchPaths() in internal/config/template/parser.go use a lexical filepath.Rel check and a leaf-only os.Lstat check that fail to resolve intermediate directory symlinks. This allows a repository to contain a path where a directory points outside the checkout, causing os.ReadFile and related operations to follow the symlink and read files accessible to the runner. The read content is then rendered into the generated configuration and can be exposed via the Infracost dashboard or pull request comments, which is particularly critical in workflows that provide repository secrets.

Recommendations Update to version 0.10.45.