PT-2026-45756 · Gleam · Gleam
CVSS v4.0
5.1
Medium
| Vector | AV:L/AC:L/AT:N/PR:L/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N |
Name of the Vulnerable Software and Affected Versions
Gleam versions 0.10.0-rc1 through 1.17.0
Description
A symlink following issue in the Hex package export allows files outside the project root to be embedded in the generated package tarball. The file collection helpers
gleam files, native files, and private files in compiler-cli/src/fs.rs use follow links(true) when walking publishable directories such as src/ and priv/. These paths are then added to the package archive via add path to tar in compiler-cli/src/publish.rs without verifying that the resolved target remains within the project root. An attacker with write access to the project repository can place a symlink in src/ or priv/ pointing to arbitrary files. When a maintainer or CI pipeline executes the commands "gleam publish" or "gleam export hex-tarball", local files readable by the publisher, such as secrets, tokens, or SSH keys, are silently embedded into the published package artifact.Recommendations
Update Gleam to a version later than 1.17.0.
Avoid running "gleam publish" or "gleam export hex-tarball" on untrusted projects.
Review the contents of src/ and priv/ for unexpected symlinks before publishing.
Run publishing commands in a restricted or isolated environment, such as containers.
Exploit
Fix
Link Following
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Gleam