Atlantis vulnerabilities

Atlantis passes the pull-request-controlled workspace value from atlantis.yaml into Terraform command arguments that are joined with strings.Join and executed through sh -c. An authenticated contributor can include shell metacharacters in the workspace name, causing arbitrary commands to execute as the Atlantis service account. The issue is fixed in version 0.47.1.

Atlantis through 0.47.1 fails to authenticate the /github-app/setup endpoint, allowing unauthenticated attackers to access GitHub App credentials. Attackers can observe or intercept the GitHub redirect during setup to obtain the RSA private key and webhook secret, enabling installation token minting and webhook payload forgery.

Atlantis versions 0.19.8 through 0.45.0 do not consistently validate user-controlled workspace values. This can allow escaping the intended workspace directory and performing filesystem operations outside it, leading to integrity loss or DoS.