{"data":{"id":"a80229e4-1973-46db-91a9-05de18ce59a2","title":"CVE-2026-71493: Infracost provides cloud cost intelligence for engineers, AI coding agents, and CI/CD. Prior to 0.10.45, the readFile, p","summary":"Infracost (a tool that calculates cloud costs) had a vulnerability before version 0.10.45 where certain file-reading functions didn't properly handle symlinks (shortcuts that point to other locations). An attacker could create a symlink in a repository that points outside the checked-out code, allowing the tool to read sensitive files that the system running Infracost could access, potentially exposing repository secrets through dashboards or pull request comments.","solution":"Update Infracost to version 0.10.45 or later. The issue is fixed in version 0.10.45.","labels":["security"],"sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-71493","publishedAt":"2026-08-21T18:16:50.440Z","cveId":"CVE-2026-71493","cweIds":["CWE-22","CWE-59"],"cvssScore":null,"cvssSeverity":null,"severity":"high","attackType":["supply_chain"],"issueType":"vulnerability","affectedPackages":null,"affectedVendors":[],"affectedVendorsRaw":["Infracost"],"classifierModel":"claude-haiku-4-5-20251001","classifierPromptVersion":"v3","cvssVector":null,"attackVector":null,"attackComplexity":null,"privilegesRequired":null,"userInteraction":null,"exploitMaturity":"unknown","epssScore":0,"patchAvailable":null,"disclosureDate":"2026-08-21T18:16:50.440Z","capecIds":["CAPEC-126"],"crossRefCount":0,"attackSophistication":"moderate","impactType":["confidentiality","integrity"],"aiComponentTargeted":"api","llmSpecific":false,"classifierConfidence":0.85,"researchCategory":null,"atlasIds":["AML.T0010"]}}