CVE-2026-77156

Incomplete validation of extracted archive entry paths in ast-cli's tar extraction logic on Linux and macOS (used when installing the Vorpal ASCA real-time engine and the SCA Resolver) would allow a malicious tar archive containing absolute or traversal path entries to write files outside the install directory. Windows builds were not affected, as the Windows extractor performs this path validation. Exploitation required substituting the archive served at "download.checkmarx.com". An attacker able to compromise that server and replace the archive could write arbitrary, executable files to arbitrary filesystem paths via this path traversal. Extraction now validates that each entry's destination path resolves within the working directory and rejects absolute paths.

CVSS v3 6.4 MEDIUM

6.4^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 0.5 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity HIGH

Privileges Required HIGH

User Interaction REQUIRED

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://github.com/Checkmarx/ast-cli
https://github.com/Checkmarx/ast-cli/security/advisories/GHSA-9gff-3q53-q75x

Configurations

No configuration.

History

22 Oct 2026, 18:17

Type	Values Removed	Values Added
New CVE

Information

Published : 2026-10-22 18:17

Updated : 2026-10-23 19:57

NVD link : CVE-2026-77156

Mitre link : CVE-2026-77156

CVE.ORG link : CVE-2026-77156

JSON object : View

Products Affected

No product.

CWE

CWE-22

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

{"id": "CVE-2026-77156", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "596c5446-0ce5-4ba2-aa66-48b3b757a647", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.4, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "HIGH", "availabilityImpact": "HIGH", "privilegesRequired": "HIGH", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 0.5}], "cvssMetricV40": [{"type": "Secondary", "source": "596c5446-0ce5-4ba2-aa66-48b3b757a647", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 6.3, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:N/VI:N/VA:N/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "PASSIVE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "HIGH", "subIntegrityImpact": "HIGH", "vulnIntegrityImpact": "NONE", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "HIGH", "vulnAvailabilityImpact": "NONE", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "HIGH", "vulnConfidentialityImpact": "NONE", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "596c5446-0ce5-4ba2-aa66-48b3b757a647", "affectedData": [{"repo": "https://github.com/checkmarx/ast-cli", "vendor": "Checkmarx", "product": "github.com/checkmarx/ast-cli", "versions": [{"status": "affected", "version": "0", "lessThan": "2.3.51", "versionType": "semver"}, {"status": "unaffected", "version": "2.3.51", "versionType": "semver"}], "platforms": ["MacOS", "Linux"], "packageName": "github.com/checkmarx/ast-cli", "collectionURL": "https://golang.org/pkg", "defaultStatus": "unaffected"}]}], "published": "2026-10-22T18:17:29.463", "references": [{"url": "https://github.com/Checkmarx/ast-cli", "source": "596c5446-0ce5-4ba2-aa66-48b3b757a647"}, {"url": "https://github.com/Checkmarx/ast-cli/security/advisories/GHSA-9gff-3q53-q75x", "source": "596c5446-0ce5-4ba2-aa66-48b3b757a647"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "596c5446-0ce5-4ba2-aa66-48b3b757a647", "description": [{"lang": "en", "value": "CWE-22"}]}], "descriptions": [{"lang": "en", "value": "Incomplete validation of extracted archive entry paths in ast-cli's tar extraction logic on Linux and macOS (used when installing the Vorpal ASCA real-time engine and the SCA Resolver) would allow a malicious tar archive containing absolute or traversal path entries to write files outside the install directory. Windows builds were not affected, as the Windows extractor performs this path validation.\n\n\n\nExploitation required substituting the archive served at \"download.checkmarx.com\". An attacker able to compromise that server and replace the archive could write arbitrary, executable files to arbitrary\u00a0filesystem paths via this path traversal.\n\n\n\nExtraction now validates that each entry's destination path resolves within the working directory and rejects absolute paths."}], "lastModified": "2026-10-23T19:57:42.660", "sourceIdentifier": "596c5446-0ce5-4ba2-aa66-48b3b757a647"}