CVE-2026-14978: hashicorp go-slug Improper Handling of Unicode Encoding
CVSS: 5.5v3.1MediumAnalyzed
AliasesCGA-2x84-8mgq-cggwCGA-2x8g-5m56-53h3CGA-3v89-p66m-92mwCGA-4xr8-wrvx-mhc6CGA-5rgc-3fq9-jr96CGA-8hj8-h8fv-8q2wCGA-9qg4-384r-329vCGA-frq2-hmh8-v6wfCGA-hh5j-h49x-ccg3CGA-jrj9-8fgw-wv86CGA-mcgg-8mjw-2fc8CGA-pj3r-gw3q-97qhCGA-q3gf-wvrh-grhcCGA-xf92-mrv9-j3rpCGA-28m9-xr6f-8fm4CGA-2qm9-rxrp-x9r9CGA-3672-w33f-hpxxCGA-492x-gr25-q3qgCGA-4c8m-4fc9-27j4CGA-4mfm-6m57-62ghCGA-4rx9-wfqh-wq87CGA-6ccm-9vq6-ggq6CGA-6rvr-7v35-j5h5CGA-7xx6-r432-gc42CGA-8p56-2534-x967CGA-9prw-4vm4-6fr6CGA-c2jg-fph4-5w7rCGA-c64m-cqq3-x495CGA-cm3w-gg48-f4qpCGA-f69c-2vxp-rgm3CGA-fq6q-29jg-89m6CGA-fqp7-6rx8-rf48CGA-g88p-gp4c-w6c4CGA-gfvj-6qp9-gmcmCGA-gh9m-x3q9-6c82CGA-h34q-vp3r-m66vCGA-h572-7wvm-xxjqCGA-jwmj-g6w3-mx2fCGA-mghp-h254-mfrwCGA-mrcq-p4f5-272hCGA-pqpm-gv8r-7c5vCGA-pw6f-w3j7-w7p8CGA-pwcp-gf96-p5mhCGA-qvm6-pqhg-4v6hCGA-r53r-hf8p-p4g5CGA-r7p4-chhf-wxjmCGA-r9r2-r74f-78qxCGA-vj7m-pfgw-64w5CGA-vvqx-3vmj-825qCGA-w347-3c9h-wp4rCGA-w646-8jc2-hrpcCGA-x88m-9qm8-xh9fCGA-xjf9-c6r9-jwwv
Published 19-08-2026Last modified 20-08-2026
Vulnerability summary
CVE-2026-14978 is a medium (CVSS 5.5) Improper Handling of Unicode Encoding vulnerability in hashicorp go-slug. EPSS estimates a 0.14% chance of exploitation in the next 30 days, higher than 3.1% of scored vulnerabilities.
CVSS score
5.5/10
010
Medium · v3.1 (CVE.org)EPSS score
0.14%
0%100%
Low · +0.04 pp in 30 daysKEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded
Advisory lineage
Upstream 0 · Downstream 0 · Related 1Timeline
- 19-08-2026PublishedVulnerability first disclosed.
- 20-08-2026Last modifiedVulnerability information updated.
Description
HashiCorp go-slug 0.4.0 through 0.18.2 could allow a local attacker to bypass .terraformignore exclusions and cause sensitive files to be included in Terraform slug uploads due to improper handling of Unicode normalization during path matching.
CVSS metrics
4 scores · 4 sources · 1 versionMedium 5.5Preferred score · CVE.org (CNA)
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:NSourcesAll 4 agree
- OSV · WolfiEcosystem advisory · calculated5.5MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
- OSV · ChainguardEcosystem advisory · calculated5.5MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
- NVDNIST5.5MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
EPSS trend
Probability
0.14%
Chance of exploitation in the next 30 days
Percentile
3%
Versus all other CVEs
30-day change
+0.04 pp
From 0.10% on 20-09-2026
20-09-202620-10-2026
EPSS score0.14%
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Chainguard27 products
- helmfile< 1.7.4-r6
- opentofu-1.10< 1.10.10-r20
- opentofu-1.11< 1.11.14-r6 | < 1.11.14-r5
- opentofu-1.12< 1.12.6-r5 | < 1.12.6-r6
- opentofu-1.12-compat< 1.12.6-r6
Wolfi7 products
- opentofu-1.10< 1.10.10-r20
- opentofu-1.11< 1.11.14-r6 | < 1.11.14-r5
- opentofu-1.12< 1.12.6-r5 | < 1.12.6-r6
- opentofu-1.12-compat< 1.12.6-r6
- opentofu-1.9< 1.9.4-r30
Hashicorp1 product
- go-slug≥ 0.4.0, ≤ 0.18.2 | ≥ 0.4.0, < 0.18.3
3 vendors · 35 products