Advisories for Golang/Github.com/Infracost/Infracost package

Sensitive information exposure in the Infracost Terraform Cloud/Enterprise integration. Several code paths attached a configured secret token to a request whose host was taken straight from the scanned Terraform, with no check that the host was the trusted endpoint. The condition that matters is whether a Terraform Cloud/Enterprise (or registry) token is present in the run: if one is, the injected hostname can disclose it. Impact therefore depends on the …

Path traversal via link following in the Infracost config-template parser. The readFile, pathExists, isDir, and matchPaths template functions confined repo-supplied paths with a lexical filepath.Rel check plus a leaf-only os.Lstat: {{ readFile "evil/file" }} With an intermediate directory symlink committed in the repo (evil -> /), the path is lexically clean and the leaf is a regular file, so both checks pass, but os.ReadFile follows the symlink and reads outside …