Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.
Open advisories
4 actionable advisories, newest first. Withdrawn advisories and news are excluded. Coverage is partial.
Go github.com/runatlantis/atlantis >= 0.4.0, < 0.47.1
Fixed in
0.47.1· Vendor fix available
Issue
Atlantis passes the Terraform `workspace` value from a pull request's `atlantis.yaml` into a shell command without quoting or escaping it. A contributor whose pull request is eligible for an Atlantis plan can include shell metacharacters in the workspace name and execute arbitrary commands as the Atlantis service account. This does not require custom workflows, `allow_custom_workflows`, or permission to run `terraform apply`. The executed command inherits the Atlantis process environment, which commonly contains cloud-provider, Terraform, and VCS credentials. Details Verified against current `upstream/main` commit `92ce5c51d1a050357e44df3535483425e59fa984` on August 13, 2026. The vulnerable data flow is: 1. The PR-controlled project workspace is validated in `server/core/config/raw/project.go`. Validation rejects only `..`, `/`, and `\`.…
Recommended action: Upgrade to 0.47.1 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Go github.com/runatlantis/atlantis >= 0.19.8, < 0.45.0
Fixed in
0.45.0· Vendor fix available
Issue
Atlantis versions = 0.19.8 and < 0.45.0 did not consistently validate user-controlled workspace values before using them to construct local workspace paths. A crafted workspace value containing path traversal segments could cause Atlantis to resolve workspace paths outside the intended per-pull workspace directory. In vulnerable versions or code paths, Atlantis could create, use, or remove/recreate out-of-bounds directories with the privileges of the Atlantis process user, before Terraform rejected the invalid workspace name. The issue is fixed in Atlantis 0.45.0. Details The issue is a path traversal vulnerability in Atlantis workspace handling. workspace values can be supplied through repository-level atlantis.yaml configuration accepted by the server or through authenticated API input. A value such as ../../../../../../../../tmp/f1-canary could escape the intended Atlantis workspace root. In affected code paths, Atlantis used the resolved workspace path for local…
Recommended action: Upgrade to 0.45.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Short summary of the problem. Make the impact and severity as clear as possible. For example: An unsafe deserialization vulnerability allows any unauthenticated user to execute arbitrary code on the server. Atlantis logs contains GitHub credentials (tokens ghs...) when they are rotated. This enables an attacker able to read these logs to impersonate Atlantis application and to perform actions on GitHub. When Atlantis is used to administer a GitHub organization, this enables getting administration privileges on the organization. This was reported in https://github.com/runatlantis/atlantis/issues/4060 and fixed in https://github.com/runatlantis/atlantis/pull/4667 . The fix was included in Atlantis v0.30.0. Details Give all details on the vulnerability. Pointing to the incriminated source code is very helpful for the maintainer. While auditing the Kubernetes/Argo CD/Atlantis deployment of some company, the following set-up was encountered: - Most employees have read-only access…
Recommended action: Upgrade to 0.30.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
The package github.com/runatlantis/atlantis/server/controllers/events before 0.19.7 is vulnerable to Timing Attack in the webhook event validator code, which does not use a constant-time comparison function to validate the webhook secret. It can allow an attacker to recover this secret as an attacker and then forge webhook events.
Recommended action: Upgrade to 0.19.7 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.