Executive brief
Infracost is a tool that analyzes infrastructure costs from code repositories. A vulnerability in its template processing allows anyone who can open a pull request to read sensitive files from the CI runner, such as repository secrets or environment credentials. By committing a crafted directory symlink, an attacker can bypass path checks and read any file the CLI process can access. The risk is highest when Infracost runs under pull_request_target mode or processes same-repository pull requests, where secrets may be available.
Technical details
The vulnerability is a symlink-following path traversal affecting four template functions: readFile, pathExists, isDir, and matchPaths. These functions used lexical filepath.Rel checks and leaf-only os.Lstat validation, but failed to resolve symlinks in directory components. An attacker can commit an intermediate directory symlink (e.g., evil -> /) into the repository; subsequent path references like "evil/file" pass both checks but os.ReadFile follows the symlink and reads outside the checkout. File contents are rendered into generated configs and exposed via the Infracost dashboard and PR comments. The fix, released in v0.10.45, routes all four functions through security.IsPathAllowed, which resolves symlinks throughout the path before enforcing segment-aware containment. Network-accessible CI runners and the ability to submit pull requests are the primary attack prerequisites; impact ranges from limited file exposure (under standard pull_request triggers) to secret theft (under pull_request_target or same-repo triggers).
Affected products
- Infracost Infracost < 0.10.45
Timeline
- 2026-08-07: disclosed
- 2026-09-08: advisory
- 2026: patched: Fixed in v0.10.45 via PR #3586