FKIE_CVE-2026-42795
Vulnerability from fkie_nvd - Published: 2026-06-02 14:16 - Updated: 2026-07-22 19:10
Severity
Summary
Symlink following vulnerability in Gleam's Hex package export allows files outside the project root to be embedded in the generated package tarball.
The file collection helpers (gleam_files, native_files, private_files) in compiler-cli/src/fs.rs use follow_links(true) when walking publishable directories such as src/ and priv/. The collected paths are added to the package archive via add_path_to_tar in compiler-cli/src/publish.rs without verifying that the resolved target remains within the project root. A symlink placed under a publishable directory will cause gleam export hex-tarball or gleam publish to embed the contents of the symlink target into the generated Hex package.
An attacker with write access to the project repository can place a symlink in src/ or priv/ pointing to an arbitrary file. When a maintainer or CI pipeline runs gleam publish or gleam export hex-tarball, local files readable by the publisher (such as secrets, tokens, or SSH keys) are silently embedded into the published package artifact.
This issue affects Gleam from 0.10.0-rc1 until 1.17.0.
References
Impacted products
| Vendor | Product | Version |
|---|
{
"affected": [
{
"affectedData": [
{
"cpes": [
"cpe:2.3:a:gleam-lang:gleam:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"modules": [
"compiler-cli"
],
"packageName": "gleam",
"packageURL": "pkg:sid/gleam.run/gleam",
"product": "Gleam",
"programFiles": [
"compiler-cli/src/fs.rs",
"compiler-cli/src/publish.rs"
],
"programRoutines": [
{
"name": "compiler_cli::fs::gleam_files"
},
{
"name": "compiler_cli::fs::native_files"
},
{
"name": "compiler_cli::fs::private_files"
},
{
"name": "compiler_cli::publish::project_files"
},
{
"name": "compiler_cli::publish::add_path_to_tar"
}
],
"vendor": "Gleam",
"versions": [
{
"lessThan": "1.17.0",
"status": "affected",
"version": "0.10.0-rc1",
"versionType": "semver"
}
]
},
{
"collectionURL": "https://github.com",
"cpes": [
"cpe:2.3:a:gleam-lang:gleam:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"modules": [
"compiler-cli"
],
"packageName": "gleam-lang/gleam",
"packageURL": "pkg:github/gleam-lang/gleam",
"product": "Gleam",
"programFiles": [
"compiler-cli/src/fs.rs",
"compiler-cli/src/publish.rs"
],
"programRoutines": [
{
"name": "compiler_cli::fs::gleam_files"
},
{
"name": "compiler_cli::fs::native_files"
},
{
"name": "compiler_cli::fs::private_files"
},
{
"name": "compiler_cli::publish::project_files"
},
{
"name": "compiler_cli::publish::add_path_to_tar"
}
],
"repo": "https://github.com/gleam-lang/gleam",
"vendor": "Gleam",
"versions": [
{
"lessThan": "1.17.0",
"status": "affected",
"version": "0.10.0-rc1",
"versionType": "semver"
},
{
"lessThan": "6435a5528b9ae0449e2f32be579641ec485f6866",
"status": "affected",
"version": "c82a2d83bd0c06cafdc196820deb3f89a9b3ff7c",
"versionType": "git"
}
]
},
{
"collectionURL": "https://ghcr.io",
"cpes": [
"cpe:2.3:a:gleam-lang:gleam:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"modules": [
"compiler-cli"
],
"packageName": "gleam-lang/gleam",
"packageURL": "pkg:oci/gleam?repository_url=ghcr.io/gleam-lang",
"product": "Gleam",
"programFiles": [
"compiler-cli/src/fs.rs",
"compiler-cli/src/publish.rs"
],
"programRoutines": [
{
"name": "compiler_cli::fs::gleam_files"
},
{
"name": "compiler_cli::fs::native_files"
},
{
"name": "compiler_cli::fs::private_files"
},
{
"name": "compiler_cli::publish::project_files"
},
{
"name": "compiler_cli::publish::add_path_to_tar"
}
],
"vendor": "Gleam",
"versions": [
{
"lessThan": "v1.17.0-elixir",
"status": "affected",
"version": "v0.10.0-rc1-elixir",
"versionType": "other"
},
{
"lessThan": "v1.17.0-erlang",
"status": "affected",
"version": "v0.10.0-rc1-erlang",
"versionType": "other"
},
{
"lessThan": "v1.17.0-node",
"status": "affected",
"version": "v0.10.0-rc1-node",
"versionType": "other"
},
{
"lessThan": "v1.17.0-node-slim",
"status": "affected",
"version": "v0.10.0-rc1-node-slim",
"versionType": "other"
},
{
"lessThan": "v1.17.0-elixir-slim",
"status": "affected",
"version": "v0.10.0-rc1-elixir-slim",
"versionType": "other"
},
{
"lessThan": "v1.17.0-erlang-slim",
"status": "affected",
"version": "v0.10.0-rc1-erlang-slim",
"versionType": "other"
},
{
"lessThan": "v1.17.0-erlang-alpine",
"status": "affected",
"version": "v0.10.0-rc1-erlang-alpine",
"versionType": "other"
},
{
"lessThan": "v1.17.0-elixir-alpine",
"status": "affected",
"version": "v0.10.0-rc1-elixir-alpine",
"versionType": "other"
},
{
"lessThan": "v1.17.0-node-alpine",
"status": "affected",
"version": "v0.10.0-rc1-node-alpine",
"versionType": "other"
},
{
"lessThan": "v1.17.0-scratch",
"status": "affected",
"version": "v0.10.0-rc1-scratch",
"versionType": "other"
}
]
}
],
"source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db"
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Symlink following vulnerability in Gleam\u0027s Hex package export allows files outside the project root to be embedded in the generated package tarball.\n\nThe file collection helpers (gleam_files, native_files, private_files) in compiler-cli/src/fs.rs use follow_links(true) when walking publishable directories such as src/ and priv/. The collected paths are added to the package archive via add_path_to_tar in compiler-cli/src/publish.rs without verifying that the resolved target remains within the project root. A symlink placed under a publishable directory will cause gleam export hex-tarball or gleam publish to embed the contents of the symlink target into the generated Hex package.\n\nAn attacker with write access to the project repository can place a symlink in src/ or priv/ pointing to an arbitrary file. When a maintainer or CI pipeline runs gleam publish or gleam export hex-tarball, local files readable by the publisher (such as secrets, tokens, or SSH keys) are silently embedded into the published package artifact.\n\nThis issue affects Gleam from 0.10.0-rc1 until 1.17.0."
},
{
"lang": "es",
"value": "Una vulnerabilidad de seguimiento de enlaces simb\u00f3licos en la exportaci\u00f3n de paquetes Hex de Gleam permite que archivos fuera de la ra\u00edz del proyecto sean incrustados en el tarball del paquete generado.\n\nLos ayudantes de recolecci\u00f3n de archivos (gleam_files, native_files, private_files) en compiler-cli/src/fs.rs usan follow_links(true) al recorrer directorios publicables como src/ y priv/. Las rutas recolectadas se a\u00f1aden al archivo del paquete a trav\u00e9s de add_path_to_tar en compiler-cli/src/publish.rs sin verificar que el objetivo resuelto permanezca dentro de la ra\u00edz del proyecto. Un enlace simb\u00f3lico colocado bajo un directorio publicable har\u00e1 que gleam export hex-tarball o gleam publish incrusten el contenido del objetivo del enlace simb\u00f3lico en el paquete Hex generado.\n\nUn atacante con acceso de escritura al repositorio del proyecto puede colocar un enlace simb\u00f3lico en src/ o priv/ apuntando a un archivo arbitrario. Cuando un mantenedor o una tuber\u00eda de CI ejecuta gleam publish o gleam export hex-tarball, los archivos locales legibles por el publicador (como secretos, tokens o claves SSH) son incrustados silenciosamente en el artefacto del paquete publicado.\n\nEste problema afecta a Gleam desde 0.10.0-rc1 hasta 1.17.0."
}
],
"id": "CVE-2026-42795",
"lastModified": "2026-07-22T19:10:00.120",
"metrics": {
"cvssMetricV40": [
{
"cvssData": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "LOCAL",
"availabilityRequirement": "NOT_DEFINED",
"baseScore": 5.1,
"baseSeverity": "MEDIUM",
"confidentialityRequirement": "NOT_DEFINED",
"exploitMaturity": "NOT_DEFINED",
"integrityRequirement": "NOT_DEFINED",
"modifiedAttackComplexity": "NOT_DEFINED",
"modifiedAttackRequirements": "NOT_DEFINED",
"modifiedAttackVector": "NOT_DEFINED",
"modifiedPrivilegesRequired": "NOT_DEFINED",
"modifiedSubAvailabilityImpact": "NOT_DEFINED",
"modifiedSubConfidentialityImpact": "NOT_DEFINED",
"modifiedSubIntegrityImpact": "NOT_DEFINED",
"modifiedUserInteraction": "NOT_DEFINED",
"modifiedVulnAvailabilityImpact": "NOT_DEFINED",
"modifiedVulnConfidentialityImpact": "NOT_DEFINED",
"modifiedVulnIntegrityImpact": "NOT_DEFINED",
"privilegesRequired": "LOW",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "ACTIVE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "NONE",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"type": "Secondary"
}
],
"ssvcV203": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"ssvcData": {
"id": "CVE-2026-42795",
"options": [
{
"exploitation": "poc"
},
{
"automatable": "no"
},
{
"technicalImpact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-06-02T15:04:06.195456Z",
"version": "2.0.3"
}
}
]
},
"published": "2026-06-02T14:16:53.883",
"references": [
{
"source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"url": "https://cna.erlef.org/cves/CVE-2026-42795.html"
},
{
"source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"url": "https://github.com/gleam-lang/gleam/commit/6435a5528b9ae0449e2f32be579641ec485f6866"
},
{
"source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"url": "https://github.com/gleam-lang/gleam/security/advisories/GHSA-qhh5-fg4c-8gqc"
},
{
"source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"url": "https://osv.dev/vulnerability/EEF-CVE-2026-42795"
},
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"url": "https://github.com/gleam-lang/gleam/security/advisories/GHSA-qhh5-fg4c-8gqc"
}
],
"sourceIdentifier": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"vulnStatus": "Deferred",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-59"
}
],
"source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"type": "Secondary"
}
]
}
Loading…
Loading…
Experimental. This forecast is provided for visualization only and may change without notice. Do not use it for operational decisions.
Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Loading…
Loading…