In HashiCorp go-slug versions 0.4.0 through 0.18.2, an improper handling of Unicode normalization during path matching allows a local attacker to bypass the .terraformignore exclusion list. The flaw is rooted in CWE‑176, where differing representations of the same Unicode string can be treated as distinct, leading the code to treat normally excluded paths as valid. When used in Terraform slug uploads, this can cause sensitive files that should have been ignored to be bundled and potentially transmitted to external services, exposing confidential data.

The vendor product affected is HashiCorp go-slug, specifically all releases from 0.4.0 up to and including 0.18.2. These versions are shipped as part of various Terraform tooling. The vendor recommends moving to version 0.18.3 or later to remediate the issue.

The CVSS score of 5.5 places this vulnerability in the moderate range. Because the exploit requires local access to the environment where the slug is built, the attack vector is local. No EPSS data is available, and the vulnerability is not listed in the CISA KEV catalog, suggesting it is not widely exploited. The primary consequence is the exposure of files that should have been excluded, which can lead to accidental disclosure of sensitive configuration or secret material.