{"id":"GO-2026-6439","revision":"c1b9e9faf8b34d0bbe219d592c6e2b76","records":[{"revision":"c1b9e9faf8b34d0bbe219d592c6e2b76","observedAt":"2026-10-24T13:19:41.952+00:00","statement":{"source":"osv","id":"GO-2026-6439","aliases":["CVE-2026-71493","GHSA-mmg6-4qmv-6pc8"],"title":"Infracost: Arbitrary file read via config-template readFile symlink traversal in github.com/infracost/infracost","description":"Infracost: Arbitrary file read via config-template readFile symlink traversal in github.com/infracost/infracost","state":0,"publishedAt":"2026-09-10T14:48:42+00:00","modifiedAt":"2026-09-10T15:15:15.758004+00:00","affected":[{"ecosystem":"Go","name":"github.com/infracost/infracost","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0"},{"kind":"fixed","version":"0.10.45"}]}],"versions":[],"rawVersionEvidence":null}],"metrics":[],"references":["https://github.com/infracost/infracost/security/advisories/GHSA-mmg6-4qmv-6pc8","https://nvd.nist.gov/vuln/detail/CVE-2026-71493","https://github.com/infracost/infracost/commit/4d39331afc0e27752d16d9d91c34583e5e8487fb","https://github.com/infracost/infracost/pull/3586","https://github.com/infracost/infracost/releases/tag/v0.10.45"],"sourceUrl":"https://osv.dev/vulnerability/GO-2026-6439","license":"OSV · upstream source license applies","key":"osv:GO-2026-6439","identifiers":["GO-2026-6439","CVE-2026-71493","GHSA-mmg6-4qmv-6pc8"]},"retained":false,"historicalAffected":[]}],"coverage":[]}