CVE-2026-71493: Infracost provides cloud cost intelligence for engineers, AI coding agents, and CI/CD. Prior to 0.10.45, the readFile, p

Infracost (a tool that calculates cloud costs) had a vulnerability before version 0.10.45 where certain file-reading functions didn't properly handle symlinks (shortcuts that point to other locations). An attacker could create a symlink in a repository that points outside the checked-out code, allowing the tool to read sensitive files that the system running Infracost could access, potentially exposing repository secrets through dashboards or pull request comments.