Terragrunt’s file cleanup routine trusts paths reconstructed from a downloaded module’s .terragrunt-module-manifest. A crafted manifest may contain absolute or traversal paths, allowing the cleanup step to delete files outside the module cache before Terraform or OpenTofu runs. The result is an arbitrary file removal that can erase local source code, configuration files, or other artefacts, thereby disrupting CI/CD pipelines or other local workflows. The weakness is a path traversal and deletion flaw (CWE‑22).

All installations of gruntwork‑io’s Terragrunt prior to version 1.0.4 are affected. Users running 1.0.3 or earlier must evaluate whether they use external modules that could supply a tampered .terragrunt‑module‑manifest.

The CVSS score of 6.9 indicates moderate severity. The EPSS score is not reported and the vulnerability is not listed in the CISA KEV catalog. Based on the description, the likely attack vector is remote through a malicious or compromised external module source that an attacker can control or influence, enabling the attacker to create a malicious manifest. Successful exploitation would allow deletion of arbitrary files that the Terragrunt process can access, potentially breaking build pipelines, removing code, or deleting configuration files. The impact is limited to the local environment where Terragrunt is executed, but it could affect continuous integration/continuous deployment workflows if unmitigated.