CVE-2026-116676

Range taken from the CVE record, check it before committing. make newentry in security/vuxml creates the vid.

  <vuln vid="FIXME (make newentry)">
    <topic>FIXME -- FIXME</topic>
    <affects>
      <package>
	<name>atlantis</name>
	<range><lt>0.47.1</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>Atlantis is a self-hosted golang application that listens for
	Terraform pull request events via webhooks. From version 0.4.0 until
	0.47.1, Atlantis passes the pull-request-controlled workspace value
	from atlantis.yaml into Terraform command arguments that are joined
	with strings.Join(args, " ") and executed through sh -c. An
	authenticated contributor whose pull request is eligible for an
	Atlantis plan can include shell metacharacters in the workspace name,
	causing arbitrary commands to execute as the Atlantis service account
	without custom workflows, apply permission, or a malicious Terraform
	provider. External contributors can reach the flaw through fork pull
	requests only when --allow-fork-prs is enabled, while eligible
	same-repository branches do not require that option. The commands
	inherit the Atlantis process environment and can access
	cloud-provider, Terraform, and version-control credentials as well as
	files, state, and network resources available to the service. This
	issue is fixed in version 0.47.1.</p>
      </body>
    </description>
    <references>
      <cvename>CVE-2026-116676</cvename>
      <url>https://nvd.nist.gov/vuln/detail/CVE-2026-116676</url>
    </references>
    <dates>
      <discovery>2026-10-27</discovery>
      <entry>2026-10-27</entry>
    </dates>
  </vuln>