This CVE exposes a path traversal vulnerability in Terragrunt's cache cleanup mechanism. When Terragrunt downloads external modules, it stores them in a module cache and later cleans up those artifacts using path data decoded from a downloaded manifest file. The vulnerability allows that path data to escape the module cache directory entirely — meaning a malicious or compromised module registry could craft manifest entries that point Terragrunt's deletion logic at arbitrary paths within the process's access scope.
The CVSS score of 6.9 badly understates the risk. Terragrunt almost exclusively runs in CI/CD pipelines, where it executes with service account credentials, operates on shared cache volumes, and often has access to source code and build artifacts belonging to other pipelines. The deletion-only primitive becomes a supply chain weapon in this context: an attacker who compromises a module or registry can corrupt the build that ships your authentication infrastructure before anyone notices.
This is not a novel vulnerability class in IaC tooling. Path traversal issues in Terraform module registry responses were documented as CVEs around 2020-2021, with post-mortems that explicitly warned against trusting manifest path data from external sources. Those lessons were not propagated as general IaC orchestration invariants — they were filed as Terraform-specific incidents. Terragrunt's vulnerability is a third or fourth recurrence of the same pattern, each time treated as a discovery rather than a recurrence.
For defenders: verify your Terragrunt version includes the path sanitization fix. Beyond patching, treat your module registry ecosystem as an attack surface rather than a convenience — consider pinning to specific module versions and auditing which registries your pipelines pull from. The underlying lesson isn't technical difficulty; it's that the IaC ecosystem has persistently failed to treat downloaded manifest metadata as untrusted input, and that failure keeps reproducing.