{"schemaVersion":3,"id":"CVE-2026-14978","aliases":["CGA-2x84-8mgq-cggw","CGA-2x8g-5m56-53h3","CGA-3v89-p66m-92mw","CGA-4xr8-wrvx-mhc6","CGA-5rgc-3fq9-jr96","CGA-8hj8-h8fv-8q2w","CGA-9qg4-384r-329v","CGA-frq2-hmh8-v6wf","CGA-hh5j-h49x-ccg3","CGA-jrj9-8fgw-wv86","CGA-mcgg-8mjw-2fc8","CGA-pj3r-gw3q-97qh","CGA-q3gf-wvrh-grhc","CGA-xf92-mrv9-j3rp","CGA-28m9-xr6f-8fm4","CGA-2qm9-rxrp-x9r9","CGA-3672-w33f-hpxx","CGA-492x-gr25-q3qg","CGA-4c8m-4fc9-27j4","CGA-4mfm-6m57-62gh","CGA-4rx9-wfqh-wq87","CGA-6ccm-9vq6-ggq6","CGA-6rvr-7v35-j5h5","CGA-7xx6-r432-gc42","CGA-8p56-2534-x967","CGA-9prw-4vm4-6fr6","CGA-c2jg-fph4-5w7r","CGA-c64m-cqq3-x495","CGA-cm3w-gg48-f4qp","CGA-f69c-2vxp-rgm3","CGA-fq6q-29jg-89m6","CGA-fqp7-6rx8-rf48","CGA-g88p-gp4c-w6c4","CGA-gfvj-6qp9-gmcm","CGA-gh9m-x3q9-6c82","CGA-h34q-vp3r-m66v","CGA-h572-7wvm-xxjq","CGA-jwmj-g6w3-mx2f","CGA-mghp-h254-mfrw","CGA-mrcq-p4f5-272h","CGA-pqpm-gv8r-7c5v","CGA-pw6f-w3j7-w7p8","CGA-pwcp-gf96-p5mh","CGA-qvm6-pqhg-4v6h","CGA-r53r-hf8p-p4g5","CGA-r7p4-chhf-wxjm","CGA-r9r2-r74f-78qx","CGA-vj7m-pfgw-64w5","CGA-vvqx-3vmj-825q","CGA-w347-3c9h-wp4r","CGA-w646-8jc2-hrpc","CGA-x88m-9qm8-xh9f","CGA-xjf9-c6r9-jwwv"],"status":"published","duplicateOf":null,"title":null,"description":"HashiCorp go-slug 0.4.0 through 0.18.2 could allow a local attacker to bypass .terraformignore exclusions and cause sensitive files to be included in Terraform slug uploads due to improper handling of Unicode normalization during path matching.","dates":{"published":"2026-08-19T21:08:16.154Z","modified":"2026-08-20T15:20:13.504Z","reserved":null,"kevAdded":[],"kevDue":[]},"cvss":{"headline":{"score":5.5,"severity":"medium","version":"3.1","versionLabel":"v3.1","source":"CVE.org","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N","computed":false,"selection":"backend-summary"},"metrics":[{"version":"3.1","versionLabel":"v3.1","source":"CVE.org","score":5.5,"severity":"medium","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N","exploitability":null,"impact":null,"computed":false},{"version":"3.1","versionLabel":"v3.1","source":"OSV · Wolfi","score":5.5,"severity":"medium","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","exploitability":4.6,"impact":6,"computed":true},{"version":"3.1","versionLabel":"v3.1","source":"OSV · Chainguard","score":5.5,"severity":"medium","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","exploitability":4.6,"impact":6,"computed":true},{"version":"3.1","versionLabel":"v3.1","source":"NVD","score":5.5,"severity":"medium","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","exploitability":null,"impact":null,"computed":false}]},"epss":{"probability":0.00142,"percentile":0.03142,"severity":"low","asOf":"2026-10-21T00:00:00.000Z","change":{"pp":0.03899999999999999,"baselineDate":"2026-09-21T00:00:00.000Z","baselineScore":0.00103},"history":[{"date":"2026-09-14T00:00:00.000Z","score":0.00103,"percentile":null},{"date":"2026-09-15T00:00:00.000Z","score":0.00103,"percentile":null},{"date":"2026-09-16T00:00:00.000Z","score":0.00103,"percentile":null},{"date":"2026-09-17T00:00:00.000Z","score":0.00103,"percentile":null},{"date":"2026-09-18T00:00:00.000Z","score":0.00103,"percentile":null},{"date":"2026-09-19T00:00:00.000Z","score":0.00103,"percentile":null},{"date":"2026-09-20T00:00:00.000Z","score":0.00103,"percentile":null},{"date":"2026-09-21T00:00:00.000Z","score":0.00103,"percentile":null},{"date":"2026-09-22T00:00:00.000Z","score":0.00103,"percentile":null},{"date":"2026-09-23T00:00:00.000Z","score":0.00103,"percentile":null},{"date":"2026-09-24T00:00:00.000Z","score":0.00142,"percentile":null},{"date":"2026-09-25T00:00:00.000Z","score":0.00142,"percentile":null},{"date":"2026-09-26T00:00:00.000Z","score":0.00142,"percentile":null},{"date":"2026-09-27T00:00:00.000Z","score":0.00142,"percentile":null},{"date":"2026-09-28T00:00:00.000Z","score":0.00142,"percentile":null},{"date":"2026-09-29T00:00:00.000Z","score":0.00142,"percentile":null},{"date":"2026-09-30T00:00:00.000Z","score":0.00142,"percentile":null},{"date":"2026-10-01T00:00:00.000Z","score":0.00142,"percentile":null},{"date":"2026-10-02T00:00:00.000Z","score":0.00142,"percentile":null},{"date":"2026-10-03T00:00:00.000Z","score":0.00142,"percentile":null},{"date":"2026-10-04T00:00:00.000Z","score":0.00142,"percentile":null},{"date":"2026-10-05T00:00:00.000Z","score":0.00142,"percentile":null},{"date":"2026-10-06T00:00:00.000Z","score":0.00142,"percentile":null},{"date":"2026-10-07T00:00:00.000Z","score":0.00142,"percentile":null},{"date":"2026-10-08T00:00:00.000Z","score":0.00142,"percentile":null},{"date":"2026-10-09T00:00:00.000Z","score":0.00142,"percentile":null},{"date":"2026-10-10T00:00:00.000Z","score":0.00142,"percentile":null},{"date":"2026-10-11T00:00:00.000Z","score":0.00142,"percentile":null},{"date":"2026-10-12T00:00:00.000Z","score":0.00142,"percentile":null},{"date":"2026-10-13T00:00:00.000Z","score":0.00142,"percentile":null},{"date":"2026-10-14T00:00:00.000Z","score":0.00142,"percentile":null},{"date":"2026-10-15T00:00:00.000Z","score":0.00142,"percentile":null},{"date":"2026-10-16T00:00:00.000Z","score":0.00142,"percentile":null},{"date":"2026-10-17T00:00:00.000Z","score":0.00142,"percentile":null},{"date":"2026-10-18T00:00:00.000Z","score":0.00142,"percentile":null},{"date":"2026-10-19T00:00:00.000Z","score":0.00142,"percentile":null},{"date":"2026-10-20T00:00:00.000Z","score":0.00142,"percentile":null},{"date":"2026-10-21T00:00:00.000Z","score":0.00142,"percentile":0.03142}],"last30":[{"date":"2026-09-21T00:00:00.000Z","score":0.00103,"percentile":null},{"date":"2026-09-22T00:00:00.000Z","score":0.00103,"percentile":null},{"date":"2026-09-23T00:00:00.000Z","score":0.00103,"percentile":null},{"date":"2026-09-24T00:00:00.000Z","score":0.00142,"percentile":null},{"date":"2026-09-25T00:00:00.000Z","score":0.00142,"percentile":null},{"date":"2026-09-26T00:00:00.000Z","score":0.00142,"percentile":null},{"date":"2026-09-27T00:00:00.000Z","score":0.00142,"percentile":null},{"date":"2026-09-28T00:00:00.000Z","score":0.00142,"percentile":null},{"date":"2026-09-29T00:00:00.000Z","score":0.00142,"percentile":null},{"date":"2026-09-30T00:00:00.000Z","score":0.00142,"percentile":null},{"date":"2026-10-01T00:00:00.000Z","score":0.00142,"percentile":null},{"date":"2026-10-02T00:00:00.000Z","score":0.00142,"percentile":null},{"date":"2026-10-03T00:00:00.000Z","score":0.00142,"percentile":null},{"date":"2026-10-04T00:00:00.000Z","score":0.00142,"percentile":null},{"date":"2026-10-05T00:00:00.000Z","score":0.00142,"percentile":null},{"date":"2026-10-06T00:00:00.000Z","score":0.00142,"percentile":null},{"date":"2026-10-07T00:00:00.000Z","score":0.00142,"percentile":null},{"date":"2026-10-08T00:00:00.000Z","score":0.00142,"percentile":null},{"date":"2026-10-09T00:00:00.000Z","score":0.00142,"percentile":null},{"date":"2026-10-10T00:00:00.000Z","score":0.00142,"percentile":null},{"date":"2026-10-11T00:00:00.000Z","score":0.00142,"percentile":null},{"date":"2026-10-12T00:00:00.000Z","score":0.00142,"percentile":null},{"date":"2026-10-13T00:00:00.000Z","score":0.00142,"percentile":null},{"date":"2026-10-14T00:00:00.000Z","score":0.00142,"percentile":null},{"date":"2026-10-15T00:00:00.000Z","score":0.00142,"percentile":null},{"date":"2026-10-16T00:00:00.000Z","score":0.00142,"percentile":null},{"date":"2026-10-17T00:00:00.000Z","score":0.00142,"percentile":null},{"date":"2026-10-18T00:00:00.000Z","score":0.00142,"percentile":null},{"date":"2026-10-19T00:00:00.000Z","score":0.00142,"percentile":null},{"date":"2026-10-20T00:00:00.000Z","score":0.00142,"percentile":null},{"date":"2026-10-21T00:00:00.000Z","score":0.00142,"percentile":0.03142}]},"kev":{"state":"not-listed","entries":[],"listedCount":0,"totalCatalogs":3,"catalogs":[{"source":"cisa","label":"CISA","listed":false,"entry":null},{"source":"enisa","label":"ENISA","listed":false,"entry":null},{"source":"circl","label":"CIRCL","listed":false,"entry":null}]},"ransomware":{"state":"none-recorded","sources":[]},"exploits":[],"exploitCount":0,"weaknesses":[{"id":"CWE-176","name":"Improper Handling of Unicode Encoding","description":"The product does not properly handle when an input contains Unicode encoding.","type":"weakness","status":"Draft","abstraction":"Variant","likelihoodOfExploit":null,"url":"https://cwe.mitre.org/data/definitions/176.html"}],"affected":[{"vendor":"chainguard","product":"helmfile","name":"helmfile","label":"helmfile","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/helmfile","purlType":"apk","versions":[{"text":"< 1.7.4-r6","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 1.7.4-r6","eol":null,"hubHref":null},{"vendor":"chainguard","product":"opentofu-1.10","name":"opentofu-1.10","label":"opentofu-1.10","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/opentofu-1.10","purlType":"apk","versions":[{"text":"< 1.10.10-r20","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 1.10.10-r20","eol":null,"hubHref":null},{"vendor":"chainguard","product":"opentofu-1.11","name":"opentofu-1.11","label":"opentofu-1.11","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/opentofu-1.11","purlType":"apk","versions":[{"text":"< 1.11.14-r6","noFixRecorded":false,"fixedIn":null},{"text":"< 1.11.14-r5","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 1.11.14-r6 | < 1.11.14-r5","eol":null,"hubHref":null},{"vendor":"chainguard","product":"opentofu-1.12","name":"opentofu-1.12","label":"opentofu-1.12","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/opentofu-1.12","purlType":"apk","versions":[{"text":"< 1.12.6-r5","noFixRecorded":false,"fixedIn":null},{"text":"< 1.12.6-r6","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 1.12.6-r5 | < 1.12.6-r6","eol":null,"hubHref":null},{"vendor":"chainguard","product":"opentofu-1.12-compat","name":"opentofu-1.12-compat","label":"opentofu-1.12-compat","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/opentofu-1.12-compat","purlType":"apk","versions":[{"text":"< 1.12.6-r6","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 1.12.6-r6","eol":null,"hubHref":null},{"vendor":"chainguard","product":"opentofu-1.9","name":"opentofu-1.9","label":"opentofu-1.9","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/opentofu-1.9","purlType":"apk","versions":[{"text":"< 1.9.4-r30","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 1.9.4-r30","eol":null,"hubHref":null},{"vendor":"chainguard","product":"opentofu-fips-1.10","name":"opentofu-fips-1.10","label":"opentofu-fips-1.10","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/opentofu-fips-1.10","purlType":"apk","versions":[{"text":"< 1.10.10-r16","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 1.10.10-r16","eol":null,"hubHref":null},{"vendor":"chainguard","product":"opentofu-fips-1.11","name":"opentofu-fips-1.11","label":"opentofu-fips-1.11","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/opentofu-fips-1.11","purlType":"apk","versions":[{"text":"< 1.11.14-r4","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 1.11.14-r4","eol":null,"hubHref":null},{"vendor":"chainguard","product":"opentofu-fips-1.12","name":"opentofu-fips-1.12","label":"opentofu-fips-1.12","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/opentofu-fips-1.12","purlType":"apk","versions":[{"text":"< 1.12.6-r6","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 1.12.6-r6","eol":null,"hubHref":null},{"vendor":"chainguard","product":"opentofu-fips-1.9","name":"opentofu-fips-1.9","label":"opentofu-fips-1.9","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/opentofu-fips-1.9","purlType":"apk","versions":[{"text":"< 1.9.4-r35","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 1.9.4-r35","eol":null,"hubHref":null},{"vendor":"chainguard","product":"terraform","name":"terraform","label":"terraform","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/terraform","purlType":"apk","versions":[{"text":"< 1.5.7-r61","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 1.5.7-r61","eol":null,"hubHref":null},{"vendor":"chainguard","product":"terraform-1.10","name":"terraform-1.10","label":"terraform-1.10","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/terraform-1.10","purlType":"apk","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null}],"versionsText":"All versions (No fix recorded)","eol":null,"hubHref":null},{"vendor":"chainguard","product":"terraform-1.11","name":"terraform-1.11","label":"terraform-1.11","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/terraform-1.11","purlType":"apk","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null}],"versionsText":"All versions (No fix recorded)","eol":null,"hubHref":null},{"vendor":"chainguard","product":"terraform-1.12","name":"terraform-1.12","label":"terraform-1.12","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/terraform-1.12","purlType":"apk","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null}],"versionsText":"All versions (No fix recorded)","eol":null,"hubHref":null},{"vendor":"chainguard","product":"terraform-1.13","name":"terraform-1.13","label":"terraform-1.13","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/terraform-1.13","purlType":"apk","versions":[{"text":"< 1.13.5-r28","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 1.13.5-r28","eol":null,"hubHref":null},{"vendor":"chainguard","product":"terraform-1.14","name":"terraform-1.14","label":"terraform-1.14","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/terraform-1.14","purlType":"apk","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null}],"versionsText":"All versions (No fix recorded)","eol":null,"hubHref":null},{"vendor":"chainguard","product":"terraform-1.9","name":"terraform-1.9","label":"terraform-1.9","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/terraform-1.9","purlType":"apk","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null}],"versionsText":"All versions (No fix recorded)","eol":null,"hubHref":null},{"vendor":"chainguard","product":"terraform-fips-1.13","name":"terraform-fips-1.13","label":"terraform-fips-1.13","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/terraform-fips-1.13","purlType":"apk","versions":[{"text":"< 1.13.5-r35","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 1.13.5-r35","eol":null,"hubHref":null},{"vendor":"chainguard","product":"terraform-fips-1.14","name":"terraform-fips-1.14","label":"terraform-fips-1.14","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/terraform-fips-1.14","purlType":"apk","versions":[{"text":"< 1.14.9-r20","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 1.14.9-r20","eol":null,"hubHref":null},{"vendor":"chainguard","product":"terraform-ls","name":"terraform-ls","label":"terraform-ls","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/terraform-ls","purlType":"apk","versions":[{"text":"< 0.39.0-r5","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 0.39.0-r5","eol":null,"hubHref":null},{"vendor":"chainguard","product":"terraform-mcp-server","name":"terraform-mcp-server","label":"terraform-mcp-server","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/terraform-mcp-server","purlType":"apk","versions":[{"text":"< 1.3.0-r3","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 1.3.0-r3","eol":null,"hubHref":null},{"vendor":"chainguard","product":"vault-1.21","name":"vault-1.21","label":"vault-1.21","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/vault-1.21","purlType":"apk","versions":[{"text":"< 1.21.4-r18","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 1.21.4-r18","eol":null,"hubHref":null},{"vendor":"chainguard","product":"vault-2.0","name":"vault-2.0","label":"vault-2.0","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/vault-2.0","purlType":"apk","versions":[{"text":"< 2.0.4-r5","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 2.0.4-r5","eol":null,"hubHref":null},{"vendor":"chainguard","product":"vault-2.1","name":"vault-2.1","label":"vault-2.1","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/vault-2.1","purlType":"apk","versions":[{"text":"< 2.1.0-r3","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 2.1.0-r3","eol":null,"hubHref":null},{"vendor":"chainguard","product":"vault-fips-1.21","name":"vault-fips-1.21","label":"vault-fips-1.21","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/vault-fips-1.21","purlType":"apk","versions":[{"text":"< 1.21.4-r18","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 1.21.4-r18","eol":null,"hubHref":null},{"vendor":"chainguard","product":"vault-fips-2.0","name":"vault-fips-2.0","label":"vault-fips-2.0","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/vault-fips-2.0","purlType":"apk","versions":[{"text":"< 2.0.4-r4","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 2.0.4-r4","eol":null,"hubHref":null},{"vendor":"chainguard","product":"vault-fips-2.1","name":"vault-fips-2.1","label":"vault-fips-2.1","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/vault-fips-2.1","purlType":"apk","versions":[{"text":"< 2.1.0-r3","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 2.1.0-r3","eol":null,"hubHref":null},{"vendor":"wolfi","product":"opentofu-1.10","name":"opentofu-1.10","label":"opentofu-1.10","ecosystem":"Wolfi","cpePart":null,"purl":"pkg:apk/wolfi/opentofu-1.10","purlType":"apk","versions":[{"text":"< 1.10.10-r20","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 1.10.10-r20","eol":null,"hubHref":null},{"vendor":"wolfi","product":"opentofu-1.11","name":"opentofu-1.11","label":"opentofu-1.11","ecosystem":"Wolfi","cpePart":null,"purl":"pkg:apk/wolfi/opentofu-1.11","purlType":"apk","versions":[{"text":"< 1.11.14-r6","noFixRecorded":false,"fixedIn":null},{"text":"< 1.11.14-r5","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 1.11.14-r6 | < 1.11.14-r5","eol":null,"hubHref":null},{"vendor":"wolfi","product":"opentofu-1.12","name":"opentofu-1.12","label":"opentofu-1.12","ecosystem":"Wolfi","cpePart":null,"purl":"pkg:apk/wolfi/opentofu-1.12","purlType":"apk","versions":[{"text":"< 1.12.6-r5","noFixRecorded":false,"fixedIn":null},{"text":"< 1.12.6-r6","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 1.12.6-r5 | < 1.12.6-r6","eol":null,"hubHref":null},{"vendor":"wolfi","product":"opentofu-1.12-compat","name":"opentofu-1.12-compat","label":"opentofu-1.12-compat","ecosystem":"Wolfi","cpePart":null,"purl":"pkg:apk/wolfi/opentofu-1.12-compat","purlType":"apk","versions":[{"text":"< 1.12.6-r6","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 1.12.6-r6","eol":null,"hubHref":null},{"vendor":"wolfi","product":"opentofu-1.9","name":"opentofu-1.9","label":"opentofu-1.9","ecosystem":"Wolfi","cpePart":null,"purl":"pkg:apk/wolfi/opentofu-1.9","purlType":"apk","versions":[{"text":"< 1.9.4-r30","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 1.9.4-r30","eol":null,"hubHref":null},{"vendor":"wolfi","product":"terraform","name":"terraform","label":"terraform","ecosystem":"Wolfi","cpePart":null,"purl":"pkg:apk/wolfi/terraform","purlType":"apk","versions":[{"text":"< 1.5.7-r61","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 1.5.7-r61","eol":null,"hubHref":null},{"vendor":"wolfi","product":"terraform-mcp-server","name":"terraform-mcp-server","label":"terraform-mcp-server","ecosystem":"Wolfi","cpePart":null,"purl":"pkg:apk/wolfi/terraform-mcp-server","purlType":"apk","versions":[{"text":"< 1.3.0-r3","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 1.3.0-r3","eol":null,"hubHref":null},{"vendor":"hashicorp","product":"go-slug","name":"go-slug","label":"go-slug","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"≥ 0.4.0, ≤ 0.18.2","noFixRecorded":false,"fixedIn":null},{"text":"≥ 0.4.0, < 0.18.3","noFixRecorded":false,"fixedIn":null}],"versionsText":"≥ 0.4.0, ≤ 0.18.2 | ≥ 0.4.0, < 0.18.3","eol":null,"hubHref":"/vendor/hashicorp/go-slug"}],"affectedCount":35,"eol":{"hasEol":false,"count":0},"references":[{"url":"https://www.ibm.com/support/pages/node/7284170","label":"www.ibm.com/support/pages/node/7284170","hostname":"www.ibm.com","tags":["Vendor Advisory","Patch","Advisory"]}],"lineage":{"upstream":[],"downstream":[],"duplicates":[],"related":["CGA-9872-X6FM-RG9G"]},"timeline":[{"kind":"published","date":"2026-08-19T21:08:16.154Z","label":"Published","detail":"Vulnerability first disclosed.","source":null},{"kind":"modified","date":"2026-08-20T15:20:13.504Z","label":"Last modified","detail":"Vulnerability information updated.","source":null}],"risk":{"score":22,"level":"low","profile":"Default","thresholds":{"critical":75,"high":50,"medium":25,"low":10}},"meta":{"dataAsOf":"2026-10-21T22:51:17.363Z","stale":false,"partial":false}}