Atlantis: OS command injection via PR-controlled Terraform workspace
Summary
Atlantis, a self-hosted application that runs Terraform plans and applies from pull request webhooks, passes the workspace value from atlantis.yaml unescaped into a shell command. An authenticated contributor whose pull request is eligible for an Atlantis plan can include shell metacharacters in the workspace name and execute arbitrary commands as the Atlantis service account. No custom workflow, apply permission or malicious Terraform provider is required. Commands inherit the Atlantis environment, which may contain cloud-provider, Terraform and version-control credentials.
Affected
- Atlantis from 0.4.0 before 0.47.1
- External fork pull requests are only exposed when --allow-fork-prs is enabled; same-repository branches are not affected by that option
Fixed in
- Upgrade to Atlantis 0.47.1 or later
Workaround
Unknown.
Exploitation
- Public technical details exist in the GitHub security advisory, including a reproduction.
- No confirmed exploitation in the wild found at the time of writing.
- CISA KEV catalog status not verified directly.
- EPSS: 0.47 % (percentile 40).
Our recommendation
- Upgrade Atlantis to 0.47.1 or later. Review the behaviour change noted in the upstream release history before upgrading.
- Check whether --allow-fork-prs is set and disable it if fork pull requests are not needed.
- Restrict who can open pull requests that trigger plans, especially for developers and contractors with repository write access.
- Review recent pull request comments and atlantis.yaml history for shell control characters in workspace names.
- Review and rotate the cloud, Terraform and VCS credentials the Atlantis service account can access, as a precaution.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- GitHub Security Advisory GHSA-rjh2-4xgw-p2hj github.com
- Atlantis release v0.47.1 github.com
- Fix commit 8dd22b4 github.com
- Backport pull request #6792 github.com
- OSV GHSA-rjh2-4xgw-p2hj osv.dev
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 10:08.
Original description (NVD)
Atlantis is a self-hosted golang application that listens for Terraform pull request events via webhooks. From version 0.4.0 until 0.47.1, Atlantis passes the pull-request-controlled workspace value from atlantis.yaml into Terraform command arguments that are joined with strings.Join(args, " ") and executed through sh -c. An authenticated contributor whose pull request is eligible for an Atlantis plan can include shell metacharacters in the workspace name, causing arbitrary commands to execute as the Atlantis service account without custom workflows, apply permission, or a malicious Terraform provider. External contributors can reach the flaw through fork pull requests only when --allow-fork-prs is enabled, while eligible same-repository branches do not require that option. The commands inherit the Atlantis process environment and can access cloud-provider, Terraform, and version-control credentials as well as files, state, and network resources available to the service. This issue is fixed in version 0.47.1.
NVD references (5)
- https://github.com/runatlantis/atlantis/commit/8dd22b4d0a9d7c129fdbf6a3398dd1c4cf8c3a59
- https://github.com/runatlantis/atlantis/commit/f04df0d53f0544d9eb6f5026dd8b74fbefd82ac8
- https://github.com/runatlantis/atlantis/pull/6792
- https://github.com/runatlantis/atlantis/releases/tag/v0.47.1
- https://github.com/runatlantis/atlantis/security/advisories/GHSA-rjh2-4xgw-p2hj
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.