CVE-2026-71493

Infracost: Arbitrary file read via config-template readFile symlink traversal

Workarounds

No full fix without upgrading. To limit exposure: run Infracost under on: pull_request rather than pull_request_target, and keep fork pull requests from receiving secrets (the defaults).

Path traversal via link following in the Infracost config-template parser. The readFile, pathExists, isDir, and matchPaths template functions confined repo-supplied paths with a lexical filepath.Rel check plus a leaf-only os.Lstat:

{{ readFile "evil/file" }}

With an intermediate directory symlink committed in the repo (evil -> /), the path is lexically clean and the leaf is a regular file, so both checks pass, but os.ReadFile follows the symlink and reads outside the checkout. The contents are rendered into the generated config and surfaced via the Infracost dashboard and PR comment, so anyone who can open a pull request can read files off the runner.

Affects infracost up to and including v0.10.44. Successful exploitation reads any file the CLI process can reach on the runner. Impact depends on what the run exposes: under on: pull_request (the configuration in Infracost's documentation) fork pull requests run without secrets and with a read-only token, so exposure is limited. If Infracost runs under pull_request_target, or is triggered by a same-repository pull request, the read reaches the repository's secrets, enabling secret theft. The patch confines all four functions regardless of trigger.

Input manipulates file paths to reach files outside the intended directory, such as configuration or credential files. Typical impact: unauthorized file read or write outside the intended directory.

Kodem intelligence

Already deployed Kodem?

Fixed in v0.10.45 (#3586) by routing all four functions through security.IsPathAllowed, which resolves symlinks anywhere in the path before a segment-aware containment check. The same fix landed in config#14 and parser#144.

• Installed via the official script, a package manager, or the latest Docker tag: upgrade to v0.10.45 (or later) to receive the fix.
• Pinned to a specific version or image digest: bump to v0.10.45.

1. What is CVE-2026-71493? CVE-2026-71493 is a medium-severity path traversal vulnerability in github.com/infracost/infracost (go), affecting versions < 0.10.45. It is fixed in 0.10.45. Input manipulates file paths to reach files outside the intended directory, such as configuration or credential files.
2. Which versions of github.com/infracost/infracost are affected by CVE-2026-71493? github.com/infracost/infracost (go) versions < 0.10.45 is affected.
3. Is there a fix for CVE-2026-71493? Yes. CVE-2026-71493 is fixed in 0.10.45. Upgrade to this version or later.
4. Is CVE-2026-71493 exploitable, and should I be worried? Whether CVE-2026-71493 is exploitable in your environment depends on whether the vulnerable code is present and reachable. A CVSS score is a worst-case rating; it does not account for your specific deployment, configuration, or usage patterns. Kodem, an Intelligent Application Security platform, uses runtime intelligence to show which vulnerabilities actually execute in production, so you can focus on the ones that represent real risk. Get a demo
5. What actually determines whether CVE-2026-71493 is exploitable, and how bad it is? Exploitability and impact are not fixed properties of a CVE. They depend on runtime truth: whether the vulnerable code is present, reachable, and actually executes in your application. A high CVSS score on a dependency that never runs is not the same as real risk. Kodem, an Intelligent Application Security platform, uses runtime intelligence to reveal which vulnerabilities actually execute in production, so teams prioritize the ones that genuinely matter.
6. How do I fix CVE-2026-71493? Upgrade github.com/infracost/infracost to 0.10.45 or later.