GoPackage

github.com/runatlantis/atlantis

5 known vulnerabilities (4 high, 1 medium), with the versions each affects and the releases that fix them.

Latest release: v0.49.0 (Oct 25, 2026): affected by CVE-2025-58445
Newest unaffected release: Every release is affected by at least one advisory
Advisories: 5 · 4 high, 1 medium

Version timeline

CVE-2026-116676
Affects v0.4.0 to v0.47.0 (v0.47.1 is outside it)
CVE-2026-64679
Affects v0.19.8 to v0.44.1 (v0.45.0 is outside it)
CVE-2025-58445
Affects v0.1.0 to v0.49.0 (through the newest release)
CVE-2024-52009
Affects v0.1.0 to v0.29.0 (v0.30.0 is outside it)
CVE-2022-24912
Affects v0.1.0 to v0.19.7-pre.20220713 (v0.19.7 is outside it)

Every release cve.now has on record, lowest version on the left; each bar is a run of versions an advisory affects.

CVE-2026-116676High 8.8
Atlantis: OS command injection through PR-controlled Terraform workspace enables RCE during plan
Affected: from 0.4.0, fixed in 0.47.1.
Fixed in v0.47.1 (released Aug 20, 2026, 68 days before disclosure).
The latest release, v0.49.0, is not affected.
CVE-2026-64679High 8.1
Atlantis: Path Traversal in Atlantis Workspace Handling Allows Out-of-Bounds Directory Deletion/Creation
Affected: from 0.19.8, fixed in 0.45.0.
Fixed in v0.45.0 (released Jun 28, 2026, 54 days before disclosure).
The latest release, v0.49.0, is not affected.
CVE-2025-58445Medium 6.9
Atlantis Exposes Service Version Publicly on /status API Endpoint
Affected: through 0.35.1; all versions.
No fix released. The latest release, v0.49.0, is still affected.
CVE-2024-52009High 8.5
Git credentials are exposed in atlantis logs
Affected: fixed in 0.30.0.
Fixed in v0.30.0 (released Sep 30, 2024, 39 days before disclosure).
The latest release, v0.49.0, is not affected.
CVE-2022-24912High 7.5
Timing Attack
Affected: fixed in 0.19.7.
Fixed in v0.19.7 (released Jul 19, 2022, 10 days before disclosure).
The latest release, v0.49.0, is not affected.