CVE-2026-45099: Terragrunt: Arbitrary File Deletion via Malicious Module Manifest

August 17, 2026

Terragrunt is vulnerable to an arbitrary file deletion flaw when downloading external modules. If a remote module contains a maliciously crafted .terragrunt-module-manifest file, Terragrunt can be tricked into deleting files anywhere on the local filesystem that the Terragrunt process has access to.

References

github.com/advisories/GHSA-8394-6f8r-whxg
github.com/gruntwork-io/terragrunt/releases/tag/v1.0.4
github.com/gruntwork-io/terragrunt/security/advisories/GHSA-8394-6f8r-whxg
nvd.nist.gov/vuln/detail/CVE-2026-45099

Code Behaviors & Features

Detect and mitigate CVE-2026-45099 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →