{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/atlantis--0.47.1/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:runatlantis:atlantis:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":8.8,"id":"CVE-2026-116676"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Atlantis (\u003c 0.47.1)"],"_cs_severities":["high"],"_cs_tags":[],"_cs_type":"advisory","_cs_vendors":["Atlantis"],"content_html":"\u003cp\u003eAtlantis versions 0.4.0 through 0.47.0 are vulnerable to command injection through the workspace value defined in the atlantis.yaml configuration file. This vulnerability arises because the workspace parameter is improperly sanitized before being included in a Terraform command argument joined and executed via sh -c. An authenticated contributor can inject shell metacharacters into the workspace name to execute arbitrary commands with the privileges of the Atlantis service account. This allows for potential access to sensitive environment variables, cloud provider credentials, and Terraform state files. The issue is addressed in version 0.47.1.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows for arbitrary command execution as the Atlantis service user. This provides access to the process environment, including cloud-provider and version-control credentials, Terraform state files, and internal network resources reachable from the host.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpgrade Atlantis to version 0.47.1 or later immediately.\u003c/li\u003e\n\u003cli\u003eAudit atlantis.yaml configurations in existing repositories for suspicious or unconventional workspace names.\u003c/li\u003e\n\u003cli\u003eEvaluate the risk of the --allow-fork-prs flag; disable this option if not strictly required to mitigate exposure to external contributors.\u003c/li\u003e\n\u003cli\u003eMonitor the Atlantis service process for the execution of child processes that deviate from the expected Terraform workflow.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-10-27T20:04:26Z","date_published":"2026-10-27T20:04:26Z","id":"https://feed.craftedsignal.io/briefs/2026-10-atlantis-command-injection/","summary":"Atlantis versions 0.4.0 through 0.47.0 contain a command injection vulnerability where shell metacharacters in the workspace parameter can trigger arbitrary code execution as the service account.","title":"Atlantis: Command injection via atlantis.yaml workspace parameter (CVE-2026-116676)","url":"https://feed.craftedsignal.io/briefs/2026-10-atlantis-command-injection/"}],"language":"en","title":"CraftedSignal Threat Feed - Atlantis (\u003c 0.47.1)","version":"https://jsonfeed.org/version/1.1"}