PT-2026-65798 · Gleam · Gleam
CVSS v4.0
7.6
High
| Vector | AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N |
Name of the Vulnerable Software and Affected Versions
Gleam versions 0.18.0 through 1.17.x
Description
Insufficient verification of data authenticity allows an adversary in the middle to substitute forged Hex package contents during dependency resolution. While Gleam fetches package metadata from a signature-verified Hex repository, the
gleam cli::dependencies::lookup package function makes a subsequent request to an unsigned Hex API via gleam core::hex::get package release. The system records the outer checksum and dependency names from this unsigned JSON response into manifest.toml rather than using the verified metadata. An attacker capable of intercepting TLS traffic with a trusted certificate and modifying both the API response and the repository tarball can provide a forged package archive with a matching checksum. This leads to a loss of integrity as Gleam accepts and extracts the forged contents. This issue specifically affects projects that resolve or update Hex dependencies, such as when a manifest is missing or dependencies are modified.Recommendations
Update Gleam to version 1.18.0 or later.
Fix
Insufficient Verification of Data Authenticity
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Gleam