CVE-2026-103061
MediumCVSS 5.9Exploitation Probability (EPSS)
Low risk33th percentile - higher than 33% of all known CVEs
Summary
A path traversal vulnerability in gleam-lang gleam allows a malicious package publisher to delete a directory outside the project's build directory when a developer builds a project. Gleam reads the app field from the Hex package release metadata and uses it as the build directory name without validation; when a dependency fails to compile, Gleam deletes that directory with remove_dir_all. This issue affects gleam from 0.32.4 before 1.19.2.
Risk Assessment
A developer building a project with a malicious dependency may unknowingly delete important directories outside the build directory, leading to data loss or system damage. The vulnerability can be exploited by publishers of malicious packages in the Hex ecosystem.
Recommendation
Update Gleam to version 1.19.2 or later, which fixes this vulnerability. It is also recommended to verify dependencies and avoid building projects with untrusted packages.
Other vulnerabilities in gleam
See all- CVE-2026-59247High
A vulnerability in Gleam allows a man-in-the-middle attacker to substitute forged Hex package contents during dependency resolution due to insufficient verification of data authenticity. The second request to the unsigned Hex API is used instead of verified repository metadata.
- CVE-2026-43965Medium
Path traversal vulnerability in Gleam's dependency management (versions 0.18.0-rc1 through 1.17.0) allows arbitrary directory deletion via malicious build/packages/packages.toml content. Package keys are used without validation to construct paths, allowing ../ sequences to escape the intended directory.
- CVE-2026-42795Medium
A symlink following vulnerability in Gleam's Hex package export allows files outside the project root to be embedded in the generated package tarball. File collection helpers use follow_links(true) when walking publishable directories, and paths are added to the archive without verifying that the resolved target remains within the project root.
- CVE-2026-32685Medium
Path traversal vulnerability in Gleam's custom documentation pages handling (versions 1.16.0 through 1.17.0) allows arbitrary file read and write outside the intended documentation output directory. The documentation.pages[].path and .source fields are used without sufficient validation.
- CVE-2026-32146High
A path validation vulnerability in the Gleam compiler's handling of git dependencies allows arbitrary file system modification during dependency download. Dependency names from gleam.toml and manifest.toml are used in filesystem paths without sufficient validation, enabling path traversal (e.g., ../) to access files outside the intended dependency directory. A malicious dependency can delete or overwrite arbitrary directories, potentially leading to data loss or code execution.
Original NVD description (English source)
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in gleam-lang gleam allows a malicious package publisher to delete a directory outside the project's build directory when a developer builds a project. A Hex package release's metadata carries an app field with the release's OTP application name. Gleam reads this field from the hex.pm release API when it downloads dependencies and uses it as the package's build directory name without validating it (hex_manifest_package in compiler-cli/src/dependencies.rs, ProjectPaths::build_directory_for_package). When a dependency fails to compile, Gleam deletes that directory with remove_dir_all. hex.pm didn't restrict the field to a directory name before 2026-10-12, so a publisher could set it to a value such as ../../../../target or an absolute path. When a project depends on such a release directly or transitively and the release fails to compile, gleam build, gleam check, gleam run, gleam test or gleam export deletes the directory the name resolves to. For a pure Gleam package no publisher code runs. This issue affects gleam: from 0.32.4 before 1.19.2.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS