Executive brief
Terragrunt is an orchestration tool for managing Terraform and OpenTofu infrastructure deployments. A vulnerability in its module downloading mechanism allows attackers to craft malicious module metadata that tricks Terragrunt into deleting arbitrary files on the system. In CI/CD pipelines or automated deployments, this could cause service outages; on local systems, it could result in loss of source code or configuration files.
Technical details
The vulnerability exists in Terragrunt's module manifest handling. Terragrunt uses a `.terragrunt-module-manifest` file to track which files were copied into a downloaded module's working directory. During cleanup, it decodes and deletes files listed in the manifest to prepare for fresh OpenTofu/Terraform runs. The flaw is an improper input validation (CWE-20) where Terragrunt failed to verify that deletion paths remained within the module's destination directory. An attacker could forge a manifest with directory traversal paths (e.g., `../../../etc/important-file`) to delete files outside the intended cache folder. The fix introduces boundary checking to ensure all paths stay isolated within the manifest folder. No user interaction is required; exploitation happens automatically when a module is downloaded and processed. The attack vector is network-based for remote modules.
Affected products
- Gruntwork Terragrunt < 1.0.4
Timeline
- 2026-08-03: disclosed
- 2026-08-17: patched: Fixed in version 1.0.4