Atlantis (< 0.47.1)

Atlantis versions 0.4.0 through 0.47.0 contain a command injection vulnerability where shell metacharacters in the workspace parameter can trigger arbitrary code execution as the service account.