CVE-2026-42795
MediumCVSS 5.1Exploitation Probability (EPSS)
Low risk3th percentile - higher than 3% of all known CVEs
Summary
A symlink following vulnerability in Gleam's Hex package export allows files outside the project root to be embedded in the generated package tarball. File collection helpers use follow_links(true) when walking publishable directories, and paths are added to the archive without verifying that the resolved target remains within the project root.
Risk Assessment
An attacker with write access to the repository can place a symlink pointing to sensitive files (e.g., secrets, tokens, SSH keys), which will be included in the published package, leading to data leakage.
Recommendation
Update Gleam to version 1.17.0 or later, which includes a fix preventing symlink following outside the project directory.
Other vulnerabilities in Gleam
See all- CVE-2026-59247High
A vulnerability in Gleam allows a man-in-the-middle attacker to substitute forged Hex package contents during dependency resolution due to insufficient verification of data authenticity. The second request to the unsigned Hex API is used instead of verified repository metadata.
- CVE-2026-43965Medium
Path traversal vulnerability in Gleam's dependency management (versions 0.18.0-rc1 through 1.17.0) allows arbitrary directory deletion via malicious build/packages/packages.toml content. Package keys are used without validation to construct paths, allowing ../ sequences to escape the intended directory.
- CVE-2026-32685Medium
Path traversal vulnerability in Gleam's custom documentation pages handling (versions 1.16.0 through 1.17.0) allows arbitrary file read and write outside the intended documentation output directory. The documentation.pages[].path and .source fields are used without sufficient validation.
- CVE-2026-32146High
A path validation vulnerability in the Gleam compiler's handling of git dependencies allows arbitrary file system modification during dependency download. Dependency names from gleam.toml and manifest.toml are used in filesystem paths without sufficient validation, enabling path traversal (e.g., ../) to access files outside the intended dependency directory. A malicious dependency can delete or overwrite arbitrary directories, potentially leading to data loss or code execution.
Original NVD description (English source)
Symlink following vulnerability in Gleam's Hex package export allows files outside the project root to be embedded in the generated package tarball. The file collection helpers (gleam_files, native_files, private_files) in compiler-cli/src/fs.rs use follow_links(true) when walking publishable directories such as src/ and priv/. The collected paths are added to the package archive via add_path_to_tar in compiler-cli/src/publish.rs without verifying that the resolved target remains within the project root. A symlink placed under a publishable directory will cause gleam export hex-tarball or gleam publish to embed the contents of the symlink target into the generated Hex package. An attacker with write access to the project repository can place a symlink in src/ or priv/ pointing to an arbitrary file. When a maintainer or CI pipeline runs gleam publish or gleam export hex-tarball, local files readable by the publisher (such as secrets, tokens, or SSH keys) are silently embedded into the published package artifact. This issue affects Gleam from 0.10.0-rc1 until 1.17.0.