CVE-2026-43965

Path traversal vulnerability in Gleam's dependency management allows arbitrary directory deletion via malicious build/packages/packages.toml content. Package keys read from build/packages/packages.toml by LocalPackages::read_from_disc are passed without validation to paths.build_packages_package(), which constructs a filesystem path by joining the project build directory with the attacker-controlled key. The resulting path is then passed to fs::delete_directory (which calls remove_dir_all). No check is performed to ensure the path remains within the intended build/packages/ directory. Both absolute paths and relative traversal sequences (e.g. ../) are accepted as package keys, allowing deletion of arbitrary directories. An attacker who can cause a victim to run gleam deps download on a project containing a malicious build/packages/packages.toml (e.g. by committing the normally-gitignored file to a repository) can cause arbitrary directories on the victim's system to be recursively deleted. This issue affects Gleam from 0.18.0-rc1 until 1.17.0.

CVSS

No CVSS.

References

Link	Resource
https://cna.erlef.org/cves/CVE-2026-43965.html
https://github.com/gleam-lang/gleam/commit/690ca069817bee5f77a28fc3e360627c1da19291
https://github.com/gleam-lang/gleam/security/advisories/GHSA-jqvf-f6p2-wrv3
https://osv.dev/vulnerability/EEF-CVE-2026-43965
https://github.com/gleam-lang/gleam/security/advisories/GHSA-jqvf-f6p2-wrv3

Configurations

No configuration.

History

No history.

Information

Published : 2026-06-02 14:16

Updated : 2026-09-08 01:17

NVD link : CVE-2026-43965

Mitre link : CVE-2026-43965

CVE.ORG link : CVE-2026-43965

JSON object : View

Products Affected

No product.

CWE

CWE-22

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

{"id": "CVE-2026-43965", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-43965", "role": "CISA Coordinator", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-06-02T15:07:44.667204Z"}}], "cvssMetricV40": [{"type": "Secondary", "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 5.6, "Automatable": "NOT_DEFINED", "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "ACTIVE", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "NONE", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "NONE", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db", "affectedData": [{"cpes": ["cpe:2.3:a:gleam-lang:gleam:*:*:*:*:*:*:*:*"], "vendor": "Gleam", "modules": ["compiler-cli"], "product": "Gleam", "versions": [{"status": "affected", "version": "0.18.0-rc1", "lessThan": "1.17.0", "versionType": "semver"}], "packageURL": "pkg:software-id/gleam.run/gleam", "packageName": "gleam", "programFiles": ["compiler-cli/src/dependencies.rs"], "defaultStatus": "unaffected", "programRoutines": [{"name": "compiler_cli::dependencies::remove_extra_packages"}, {"name": "compiler_cli::dependencies::LocalPackages::read_from_disc"}, {"name": "compiler_cli::dependencies::LocalPackages::extra_local_packages"}]}, {"cpes": ["cpe:2.3:a:gleam-lang:gleam:*:*:*:*:*:*:*:*"], "repo": "https://github.com/gleam-lang/gleam", "vendor": "Gleam", "modules": ["compiler-cli"], "product": "Gleam", "versions": [{"status": "affected", "version": "0.18.0-rc1", "lessThan": "1.17.0", "versionType": "semver"}, {"status": "affected", "version": "ed7aec0484f10d60978b63788c8a6497590855ab", "lessThan": "690ca069817bee5f77a28fc3e360627c1da19291", "versionType": "git"}], "packageURL": "pkg:github/gleam-lang/gleam", "packageName": "gleam-lang/gleam", "programFiles": ["compiler-cli/src/dependencies.rs"], "collectionURL": "https://github.com", "defaultStatus": "unaffected", "programRoutines": [{"name": "compiler_cli::dependencies::remove_extra_packages"}, {"name": "compiler_cli::dependencies::LocalPackages::read_from_disc"}, {"name": "compiler_cli::dependencies::LocalPackages::extra_local_packages"}]}, {"cpes": ["cpe:2.3:a:gleam-lang:gleam:*:*:*:*:*:*:*:*"], "vendor": "Gleam", "modules": ["compiler-cli"], "product": "Gleam", "versions": [{"status": "affected", "version": "v0.18.0-rc1-elixir", "lessThan": "v1.17.0-elixir", "versionType": "other"}, {"status": "affected", "version": "v0.18.0-rc1-erlang", "lessThan": "v1.17.0-erlang", "versionType": "other"}, {"status": "affected", "version": "v0.18.0-rc1-node", "lessThan": "v1.17.0-node", "versionType": "other"}, {"status": "affected", "version": "v0.18.0-rc1-node-slim", "lessThan": "v1.17.0-node-slim", "versionType": "other"}, {"status": "affected", "version": "v0.18.0-rc1-elixir-slim", "lessThan": "v1.17.0-elixir-slim", "versionType": "other"}, {"status": "affected", "version": "v0.18.0-rc1-erlang-slim", "lessThan": "v1.17.0-erlang-slim", "versionType": "other"}, {"status": "affected", "version": "v0.18.0-rc1-erlang-alpine", "lessThan": "v1.17.0-erlang-alpine", "versionType": "other"}, {"status": "affected", "version": "v0.18.0-rc1-elixir-alpine", "lessThan": "v1.17.0-elixir-alpine", "versionType": "other"}, {"status": "affected", "version": "v0.18.0-rc1-node-alpine", "lessThan": "v1.17.0-node-alpine", "versionType": "other"}, {"status": "affected", "version": "v0.18.0-rc1-scratch", "lessThan": "v1.17.0-scratch", "versionType": "other"}], "packageURL": "pkg:oci/gleam?repository_url=ghcr.io/gleam-lang", "packageName": "gleam-lang/gleam", "programFiles": ["compiler-cli/src/dependencies.rs"], "collectionURL": "https://ghcr.io", "defaultStatus": "unaffected", "programRoutines": [{"name": "compiler_cli::dependencies::remove_extra_packages"}, {"name": "compiler_cli::dependencies::LocalPackages::read_from_disc"}, {"name": "compiler_cli::dependencies::LocalPackages::extra_local_packages"}]}]}], "published": "2026-06-02T14:16:54.053", "references": [{"url": "https://cna.erlef.org/cves/CVE-2026-43965.html", "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db"}, {"url": "https://github.com/gleam-lang/gleam/commit/690ca069817bee5f77a28fc3e360627c1da19291", "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db"}, {"url": "https://github.com/gleam-lang/gleam/security/advisories/GHSA-jqvf-f6p2-wrv3", "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db"}, {"url": "https://osv.dev/vulnerability/EEF-CVE-2026-43965", "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db"}, {"url": "https://github.com/gleam-lang/gleam/security/advisories/GHSA-jqvf-f6p2-wrv3", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db", "description": [{"lang": "en", "value": "CWE-22"}]}], "descriptions": [{"lang": "en", "value": "Path traversal vulnerability in Gleam's dependency management allows arbitrary directory deletion via malicious build/packages/packages.toml content.\n\nPackage keys read from build/packages/packages.toml by LocalPackages::read_from_disc are passed without validation to paths.build_packages_package(), which constructs a filesystem path by joining the project build directory with the attacker-controlled key. The resulting path is then passed to fs::delete_directory (which calls remove_dir_all). No check is performed to ensure the path remains within the intended build/packages/ directory. Both absolute paths and relative traversal sequences (e.g. ../) are accepted as package keys, allowing deletion of arbitrary directories.\n\nAn attacker who can cause a victim to run gleam deps download on a project containing a malicious build/packages/packages.toml (e.g. by committing the normally-gitignored file to a repository) can cause arbitrary directories on the victim's system to be recursively deleted.\n\nThis issue affects Gleam from 0.18.0-rc1 until 1.17.0."}, {"lang": "es", "value": "Una vulnerabilidad de salto de ruta en la gesti\u00f3n de dependencias de Gleam permite la eliminaci\u00f3n arbitraria de directorios a trav\u00e9s de contenido malicioso en build/packages/packages.toml.\n\nLas claves de paquete le\u00eddas de build/packages/packages.toml por LocalPackages::read_from_disc se pasan sin validaci\u00f3n a paths.build_packages_package(), que construye una ruta del sistema de archivos uniendo el directorio de compilaci\u00f3n del proyecto con la clave controlada por el atacante. La ruta resultante se pasa luego a fs::delete_directory (que llama a remove_dir_all). No se realiza ninguna comprobaci\u00f3n para asegurar que la ruta permanezca dentro del directorio build/packages/ previsto. Tanto las rutas absolutas como las secuencias de salto relativas (p. ej., ../) se aceptan como claves de paquete, permitiendo la eliminaci\u00f3n de directorios arbitrarios.\n\nUn atacante que puede hacer que una v\u00edctima ejecute gleam deps download en un proyecto que contenga un build/packages/packages.toml malicioso (p. ej., al confirmar el archivo normalmente ignorado por Git en un repositorio) puede hacer que se eliminen recursivamente directorios arbitrarios en el sistema de la v\u00edctima.\n\nEste problema afecta a Gleam desde la versi\u00f3n 0.18.0-rc1 hasta la 1.17.0."}], "lastModified": "2026-09-08T01:17:30.670", "sourceIdentifier": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db"}