« Volver al listado

CVE-2026-43965

Estado: AplazadaMedia (5.6)—

Path traversal vulnerability in Gleam's dependency management allows arbitrary directory deletion via malicious build/packages/packages.toml content.

Package keys read from build/packages/packages.toml by LocalPackages::read_from_disc are passed without validation to paths.build_packages_package(), which constructs a filesystem path by joining the project build directory with the attacker-controlled key. The resulting path is then passed to fs::delete_directory (which calls remove_dir_all). No check is performed to ensure the path remains within the intended build/packages/ directory. Both absolute paths and relative traversal sequences (e.g. ../) are accepted as package keys, allowing deletion of arbitrary directories.

Leer descripción completaMostrar menos

An attacker who can cause a victim to run gleam deps download on a project containing a malicious build/packages/packages.toml (e.g. by committing the normally-gitignored file to a repository) can cause arbitrary directories on the victim's system to be recursively deleted.

This issue affects Gleam from 0.18.0-rc1 until 1.17.0.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

⚠ Inferidas por IA a partir de la descripción — NVD aún no ha analizado esta CVE; no son CPE verificados.

Lpil — GleamAI

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2026-43965",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-43965",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "poc"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2026-06-02T15:07:44.667204Z"
        }
      }
    ],
    "cvssMetricV40": [
      {
        "type": "Secondary",
        "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
        "cvssData": {
          "Safety": "NOT_DEFINED",
          "version": "4.0",
          "Recovery": "NOT_DEFINED",
          "baseScore": 5.6,
          "Automatable": "NOT_DEFINED",
          "attackVector": "LOCAL",
          "baseSeverity": "MEDIUM",
          "valueDensity": "NOT_DEFINED",
          "vectorString": "CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
          "exploitMaturity": "NOT_DEFINED",
          "providerUrgency": "NOT_DEFINED",
          "userInteraction": "ACTIVE",
          "attackComplexity": "LOW",
          "attackRequirements": "PRESENT",
          "privilegesRequired": "NONE",
          "subIntegrityImpact": "NONE",
          "vulnIntegrityImpact": "NONE",
          "integrityRequirement": "NOT_DEFINED",
          "modifiedAttackVector": "NOT_DEFINED",
          "subAvailabilityImpact": "NONE",
          "vulnAvailabilityImpact": "HIGH",
          "availabilityRequirement": "NOT_DEFINED",
          "modifiedUserInteraction": "NOT_DEFINED",
          "modifiedAttackComplexity": "NOT_DEFINED",
          "subConfidentialityImpact": "NONE",
          "vulnConfidentialityImpact": "NONE",
          "confidentialityRequirement": "NOT_DEFINED",
          "modifiedAttackRequirements": "NOT_DEFINED",
          "modifiedPrivilegesRequired": "NOT_DEFINED",
          "modifiedSubIntegrityImpact": "NOT_DEFINED",
          "modifiedVulnIntegrityImpact": "NOT_DEFINED",
          "vulnerabilityResponseEffort": "NOT_DEFINED",
          "modifiedSubAvailabilityImpact": "NOT_DEFINED",
          "modifiedVulnAvailabilityImpact": "NOT_DEFINED",
          "modifiedSubConfidentialityImpact": "NOT_DEFINED",
          "modifiedVulnConfidentialityImpact": "NOT_DEFINED"
        }
      }
    ]
  },
  "affected": [
    {
      "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
      "affectedData": [
        {
          "cpes": [
            "cpe:2.3:a:gleam-lang:gleam:*:*:*:*:*:*:*:*"
          ],
          "vendor": "Gleam",
          "modules": [
            "compiler-cli"
          ],
          "product": "Gleam",
          "versions": [
            {
              "status": "affected",
              "version": "0.18.0-rc1",
              "lessThan": "1.17.0",
              "versionType": "semver"
            }
          ],
          "packageURL": "pkg:software-id/gleam.run/gleam",
          "packageName": "gleam",
          "programFiles": [
            "compiler-cli/src/dependencies.rs"
          ],
          "defaultStatus": "unaffected",
          "programRoutines": [
            {
              "name": "compiler_cli::dependencies::remove_extra_packages"
            },
            {
              "name": "compiler_cli::dependencies::LocalPackages::read_from_disc"
            },
            {
              "name": "compiler_cli::dependencies::LocalPackages::extra_local_packages"
            }
          ]
        },
        {
          "cpes": [
            "cpe:2.3:a:gleam-lang:gleam:*:*:*:*:*:*:*:*"
          ],
          "repo": "https://github.com/gleam-lang/gleam",
          "vendor": "Gleam",
          "modules": [
            "compiler-cli"
          ],
          "product": "Gleam",
          "versions": [
            {
              "status": "affected",
              "version": "0.18.0-rc1",
              "lessThan": "1.17.0",
              "versionType": "semver"
            },
            {
              "status": "affected",
              "version": "ed7aec0484f10d60978b63788c8a6497590855ab",
              "lessThan": "690ca069817bee5f77a28fc3e360627c1da19291",
              "versionType": "git"
            }
          ],
          "packageURL": "pkg:github/gleam-lang/gleam",
          "packageName": "gleam-lang/gleam",
          "programFiles": [
            "compiler-cli/src/dependencies.rs"
          ],
          "collectionURL": "https://github.com",
          "defaultStatus": "unaffected",
          "programRoutines": [
            {
              "name": "compiler_cli::dependencies::remove_extra_packages"
            },
            {
              "name": "compiler_cli::dependencies::LocalPackages::read_from_disc"
            },
            {
              "name": "compiler_cli::dependencies::LocalPackages::extra_local_packages"
            }
          ]
        },
        {
          "cpes": [
            "cpe:2.3:a:gleam-lang:gleam:*:*:*:*:*:*:*:*"
          ],
          "vendor": "Gleam",
          "modules": [
            "compiler-cli"
          ],
          "product": "Gleam",
          "versions": [
            {
              "status": "affected",
              "version": "v0.18.0-rc1-elixir",
              "lessThan": "v1.17.0-elixir",
              "versionType": "other"
            },
            {
              "status": "affected",
              "version": "v0.18.0-rc1-erlang",
              "lessThan": "v1.17.0-erlang",
              "versionType": "other"
            },
            {
              "status": "affected",
              "version": "v0.18.0-rc1-node",
              "lessThan": "v1.17.0-node",
              "versionType": "other"
            },
            {
              "status": "affected",
              "version": "v0.18.0-rc1-node-slim",
              "lessThan": "v1.17.0-node-slim",
              "versionType": "other"
            },
            {
              "status": "affected",
              "version": "v0.18.0-rc1-elixir-slim",
              "lessThan": "v1.17.0-elixir-slim",
              "versionType": "other"
            },
            {
              "status": "affected",
              "version": "v0.18.0-rc1-erlang-slim",
              "lessThan": "v1.17.0-erlang-slim",
              "versionType": "other"
            },
            {
              "status": "affected",
              "version": "v0.18.0-rc1-erlang-alpine",
              "lessThan": "v1.17.0-erlang-alpine",
              "versionType": "other"
            },
            {
              "status": "affected",
              "version": "v0.18.0-rc1-elixir-alpine",
              "lessThan": "v1.17.0-elixir-alpine",
              "versionType": "other"
            },
            {
              "status": "affected",
              "version": "v0.18.0-rc1-node-alpine",
              "lessThan": "v1.17.0-node-alpine",
              "versionType": "other"
            },
            {
              "status": "affected",
              "version": "v0.18.0-rc1-scratch",
              "lessThan": "v1.17.0-scratch",
              "versionType": "other"
            }
          ],
          "packageURL": "pkg:oci/gleam?repository_url=ghcr.io/gleam-lang",
          "packageName": "gleam-lang/gleam",
          "programFiles": [
            "compiler-cli/src/dependencies.rs"
          ],
          "collectionURL": "https://ghcr.io",
          "defaultStatus": "unaffected",
          "programRoutines": [
            {
              "name": "compiler_cli::dependencies::remove_extra_packages"
            },
            {
              "name": "compiler_cli::dependencies::LocalPackages::read_from_disc"
            },
            {
              "name": "compiler_cli::dependencies::LocalPackages::extra_local_packages"
            }
          ]
        }
      ]
    }
  ],
  "published": "2026-06-02T14:16:54.053",
  "references": [
    {
      "url": "https://cna.erlef.org/cves/CVE-2026-43965.html",
      "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db"
    },
    {
      "url": "https://github.com/gleam-lang/gleam/commit/690ca069817bee5f77a28fc3e360627c1da19291",
      "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db"
    },
    {
      "url": "https://github.com/gleam-lang/gleam/security/advisories/GHSA-jqvf-f6p2-wrv3",
      "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db"
    },
    {
      "url": "https://osv.dev/vulnerability/EEF-CVE-2026-43965",
      "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db"
    },
    {
      "url": "https://github.com/gleam-lang/gleam/security/advisories/GHSA-jqvf-f6p2-wrv3",
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"
    }
  ],
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
      "description": [
        {
          "lang": "en",
          "value": "CWE-22"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Path traversal vulnerability in Gleam's dependency management allows arbitrary directory deletion via malicious build/packages/packages.toml content.\n\nPackage keys read from build/packages/packages.toml by LocalPackages::read_from_disc are passed without validation to paths.build_packages_package(), which constructs a filesystem path by joining the project build directory with the attacker-controlled key. The resulting path is then passed to fs::delete_directory (which calls remove_dir_all). No check is performed to ensure the path remains within the intended build/packages/ directory. Both absolute paths and relative traversal sequences (e.g. ../) are accepted as package keys, allowing deletion of arbitrary directories.\n\nAn attacker who can cause a victim to run gleam deps download on a project containing a malicious build/packages/packages.toml (e.g. by committing the normally-gitignored file to a repository) can cause arbitrary directories on the victim's system to be recursively deleted.\n\nThis issue affects Gleam from 0.18.0-rc1 until 1.17.0."
    },
    {
      "lang": "es",
      "value": "Una vulnerabilidad de salto de ruta en la gestión de dependencias de Gleam permite la eliminación arbitraria de directorios a través de contenido malicioso en build/packages/packages.toml.\n\nLas claves de paquete leídas de build/packages/packages.toml por LocalPackages::read_from_disc se pasan sin validación a paths.build_packages_package(), que construye una ruta del sistema de archivos uniendo el directorio de compilación del proyecto con la clave controlada por el atacante. La ruta resultante se pasa luego a fs::delete_directory (que llama a remove_dir_all). No se realiza ninguna comprobación para asegurar que la ruta permanezca dentro del directorio build/packages/ previsto. Tanto las rutas absolutas como las secuencias de salto relativas (p. ej., ../) se aceptan como claves de paquete, permitiendo la eliminación de directorios arbitrarios.\n\nUn atacante que puede hacer que una víctima ejecute gleam deps download en un proyecto que contenga un build/packages/packages.toml malicioso (p. ej., al confirmar el archivo normalmente ignorado por Git en un repositorio) puede hacer que se eliminen recursivamente directorios arbitrarios en el sistema de la víctima.\n\nEste problema afecta a Gleam desde la versión 0.18.0-rc1 hasta la 1.17.0."
    }
  ],
  "lastModified": "2026-09-08T01:17:30.670",
  "sourceIdentifier": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db"
}