Answer in brief
CVE-2026-71493 records a Medium severity (CVSS 5.9) vulnerability in Infracost: Arbitrary file read via config-template readFile symlink traversal. The current sources do not mark it as known exploited. The current feed maps infracost/infracost (generic), github.com/infracost/infracost (go), github.com/infracost/infracost (go). Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
CVSS is 5.9. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps infracost/infracost (generic), github.com/infracost/infracost (go), github.com/infracost/infracost (go). Check affected ranges and fixed versions before updating.
| Package | Affected range | Fixed version |
|---|---|---|
| infracost/infracostgeneric | <0.10.45 | 0.10.45 |
| github.com/infracost/infracostgo | <0.10.45 | 0.10.45 |
| github.com/infracost/infracostgo | >=0 <0.10.45 | 0.10.45 |
Published upstream
Aug 21, 2026
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Sep 18, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Aug 21, 2026
Infracost provides cloud cost intelligence for engineers, AI coding agents, and CI/CD. Prior to 0.10.45, the readFile, pathExists, isDir, and matchPaths template functions in internal/config/template/parser.go use a lexical filepath.Rel check and a leaf-only os.Lstat check that do not resolve an intermediate directory symlink. A repository can contain a path such as evil/file where evil points outside the checkout, causing os.ReadFile and related operations to follow the symlink and read runner-accessible files. The resulting content is rendered into generated configuration and can be surfaced through the Infracost dashboard or pull request comment, with greater impact in workflows that provide repository secrets. This issue is fixed in version 0.10.45.
Quoted source text, attributed separately from HOL analysis.