KubeVela Terraform loader DoS via unbounded file read

The KubeVela project has disclosed a high-severity vulnerability, tracked as GHSA-fmgp-q6jx-gg3x, affecting its Terraform remote configuration loader. According to the GitHub Security Advisory database, this issue allows an attacker to cause a denial of service by exploiting the `vela-core` controller's unbounded memory consumption during file reads. Specifically, a user with permissions to create or update `ComponentDefinition` resources can register a Terraform `remote` schematic pointing to a malicious or compromised git repository. If the repository contains a symlink such as `variables.tf -> /dev/zero`, the controller reads the symlink target without verifying its size or type, leading to an out-of-memory kill.

Operators should carefully assess the permissions granted to users who can create or update `ComponentDefinition` resources, as this vulnerability relies on such access. Additionally, any upgrade or patch addressing this issue may introduce stricter validation for Terraform schematics, potentially breaking workflows that rely on unconventional repository structures. Testing in a staging environment before deployment is advisable to ensure compatibility with existing configurations.