Infracost v0.10.45 fixes symlink traversal vulnerability

The Infracost project has addressed a medium-severity security vulnerability in its config-template parser as detailed in the GitHub Security Advisory database. The issue, present in versions up to and including v0.10.44, allowed arbitrary file reads via symlink traversal when using template functions like `readFile`, `pathExists`, `isDir`, and `matchPaths`. Attackers could exploit this by committing a symlink in a repository to bypass lexical and leaf checks, enabling file reads outside the intended path. The vulnerability's impact varied depending on the GitHub Actions configuration, with `on: pull_request` limiting exposure but `pull_request_target` potentially exposing repository secrets.

The fix, implemented in v0.10.45, routes these functions through a new `security.IsPathAllowed` mechanism that resolves symlinks throughout the path and performs a segment-aware containment check. Operators are advised to upgrade to v0.10.45 or later, especially if using pinned versions or image digests. Those unable to upgrade immediately should ensure Infracost runs under `on: pull_request` to reduce risk.

Before upgrading, operators should verify their GitHub Actions configuration and ensure no workflows inadvertently use `pull_request_target` for Infracost runs. Additionally, any custom scripts or integrations relying on the affected template functions should be tested against the new version to confirm compatibility. This pattern of addressing symlink traversal vulnerabilities highlights the importance of robust path validation in tools interacting with repository contents.