PT-2026-66795 · Npm · Hashi-Vault-Js

CVE-2026-55100 · Published 2026-07-31 · Updated 2026-07-31

Positive Technologies (AI Summary)

CVSS v4.0

8.7

High

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions hashi-vault-js versions prior to 0.5.2

Description The hashi-vault-js library is susceptible to path traversal and query string injection because it concatenates identifier values directly into request paths and query strings without using encodeURIComponent() or URLSearchParams. This occurs within the Vault.js file, affecting identifiers such as name, username, group, role, and version. An attacker providing untrusted input can manipulate the request URL to redirect requests to unintended endpoints, such as administrative paths under sys/, or inject malicious parameters, executing operations based on the permissions of the application's Vault token.

Recommendations Update to version 0.5.2. As a temporary workaround, rigidly validate and sanitize all user-supplied input before passing it into the library methods, or manually encode inputs using encodeURIComponent() before providing them to the functions.

Fix

Relative Path Traversal

Special Elements Injection

Weakness Enumeration

CWE-23

CWE-74

Related Identifiers

CVE-2026-55100

GHSA-G956-2F74-RMV7

Affected Products

Hashi-Vault-Js

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2026-55100 · Security Note
• https://osv.dev/vulnerability/GHSA-g956-2f74-rmv7 · Vendor Advisory
• https://github.com/kyndryl-open-source/hashi-vault-js/pull/66 · Note
• https://github.com/kyndryl-open-source/hashi-vault-js/releases/tag/v0.5.2 · Note
• https://github.com/kyndryl-open-source/hashi-vault-js/security/advisories/GHSA-g956-2f74-rmv7 · Note
• https://github.com/kyndryl-open-source/hashi-vault-js/commit/ea2f76052d366a08f35f62ef4c12b6a334c91ec2 · Note
• https://github.com/kyndryl-open-source/hashi-vault-js · Note