Vulnerability-Lookup

CVE-2026-27640 (GCVE-0-2026-27640)

Vulnerability from cvelistv5 – Published: 2026-02-25 03:52 – Updated: 2026-02-25 03:52

Title

tfplan2md has Sensitive Value Exposure in Generated Reports

Summary

tfplan2md is software for converting Terraform plan JSON files into human-readable Markdown reports. Prior to version 1.26.1, a bug in tfplan2md affected several distinct rendering paths: AzApi resource body properties, AzureDevOps variable groups, Scriban template context variables, and hierarchical sensitivity detection. This caused reports to render values that should have been masked as "(sensitive)" instead. This issue is fixed in v1.26.1. No known workarounds are available.

Severity ?

8.5 (High)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:H/SI:H/SA:H

CWE

CWE-212 - Improper Removal of Sensitive Information Before Storage or Transfer

Assigner

GitHub_M

References

URL

Tags

	https://github.com/oocx/tfplan2md/security/adviso…	x_refsource_CONFIRM
	https://github.com/oocx/tfplan2md/releases/tag/v1.26.1	x_refsource_MISC

Impacted products

	Vendor	Product	Version
	oocx	tfplan2md	Affected: < 1.26.1

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "tfplan2md",
          "vendor": "oocx",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 1.26.1"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "tfplan2md is software for converting Terraform plan JSON files into human-readable Markdown reports. Prior to version 1.26.1, a bug in tfplan2md affected several distinct rendering paths: AzApi resource body properties, AzureDevOps variable groups, Scriban template context variables, and hierarchical sensitivity detection. This caused reports to render values that should have been masked as \"(sensitive)\" instead. This issue is fixed in v1.26.1. No known workarounds are available."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 8.5,
            "baseSeverity": "HIGH",
            "privilegesRequired": "LOW",
            "subAvailabilityImpact": "HIGH",
            "subConfidentialityImpact": "HIGH",
            "subIntegrityImpact": "HIGH",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:H/SI:H/SA:H",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "NONE"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-212",
              "description": "CWE-212: Improper Removal of Sensitive Information Before Storage or Transfer",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-02-25T03:52:26.615Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/oocx/tfplan2md/security/advisories/GHSA-5j8r-g94q-2f39",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/oocx/tfplan2md/security/advisories/GHSA-5j8r-g94q-2f39"
        },
        {
          "name": "https://github.com/oocx/tfplan2md/releases/tag/v1.26.1",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/oocx/tfplan2md/releases/tag/v1.26.1"
        }
      ],
      "source": {
        "advisory": "GHSA-5j8r-g94q-2f39",
        "discovery": "UNKNOWN"
      },
      "title": "tfplan2md has Sensitive Value Exposure in Generated Reports"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-27640",
    "datePublished": "2026-02-25T03:52:26.615Z",
    "dateReserved": "2026-02-20T22:02:30.029Z",
    "dateUpdated": "2026-02-25T03:52:26.615Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

FKIE_CVE-2026-27640

Vulnerability from fkie_nvd - Published: 2026-02-25 04:16 - Updated: 2026-02-25 04:16

Severity ?

8.5 (High) - CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:H/SI:H/SA:H