github.com/runatlantis/atlantis vulnerabilities
CVEs whose affected-version data names the github.com/runatlantis/atlantis package (go). Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.
2 CVEsRSS
CVE-2026-116676High· 8.8Atlantis: OS command injection through PR-controlled Terraform workspace enables RCE during plan
Atlantis: OS command injection through PR-controlled Terraform workspace enables RCE during plan
▾ Twilightrunatlantis · github.com/runatlantis/atlantisEPSS 0.47%via OSV
CVE-2026-64679High· 8.1Atlantis is a self-hosted golang application that listens for Terraform pull request events via webhooks
Atlantis is a self-hosted golang application that listens for Terraform pull request events via webhooks. From 0.19.8 until 0.45.0, Atlantis does not consistently validate user-controlled workspace values supplied through accepted reposi…
▾ Twilightrunatlantis · github.com/runatlantis/atlantisEPSS 0.80%via NVD