CVE-2026-43965
MediumCVSS 5.6Exploitation Probability (EPSS)
Low risk5th percentile - higher than 5% of all known CVEs
Summary
Path traversal vulnerability in Gleam's dependency management (versions 0.18.0-rc1 through 1.17.0) allows arbitrary directory deletion via malicious build/packages/packages.toml content. Package keys are used without validation to construct paths, allowing ../ sequences to escape the intended directory.
Risk Assessment
An attacker can trick a victim into running a command on a project with a malicious packages.toml file, resulting in recursive deletion of arbitrary directories on the victim's system.
Recommendation
Update Gleam to version 1.17.0 or later.
Other vulnerabilities in Gleam
See all- CVE-2026-59247High
A vulnerability in Gleam allows a man-in-the-middle attacker to substitute forged Hex package contents during dependency resolution due to insufficient verification of data authenticity. The second request to the unsigned Hex API is used instead of verified repository metadata.
- CVE-2026-42795Medium
A symlink following vulnerability in Gleam's Hex package export allows files outside the project root to be embedded in the generated package tarball. File collection helpers use follow_links(true) when walking publishable directories, and paths are added to the archive without verifying that the resolved target remains within the project root.
- CVE-2026-32685Medium
Path traversal vulnerability in Gleam's custom documentation pages handling (versions 1.16.0 through 1.17.0) allows arbitrary file read and write outside the intended documentation output directory. The documentation.pages[].path and .source fields are used without sufficient validation.
- CVE-2026-32146High
A path validation vulnerability in the Gleam compiler's handling of git dependencies allows arbitrary file system modification during dependency download. Dependency names from gleam.toml and manifest.toml are used in filesystem paths without sufficient validation, enabling path traversal (e.g., ../) to access files outside the intended dependency directory. A malicious dependency can delete or overwrite arbitrary directories, potentially leading to data loss or code execution.
Original NVD description (English source)
Path traversal vulnerability in Gleam's dependency management allows arbitrary directory deletion via malicious build/packages/packages.toml content. Package keys read from build/packages/packages.toml by LocalPackages::read_from_disc are passed without validation to paths.build_packages_package(), which constructs a filesystem path by joining the project build directory with the attacker-controlled key. The resulting path is then passed to fs::delete_directory (which calls remove_dir_all). No check is performed to ensure the path remains within the intended build/packages/ directory. Both absolute paths and relative traversal sequences (e.g. ../) are accepted as package keys, allowing deletion of arbitrary directories. An attacker who can cause a victim to run gleam deps download on a project containing a malicious build/packages/packages.toml (e.g. by committing the normally-gitignored file to a repository) can cause arbitrary directories on the victim's system to be recursively deleted. This issue affects Gleam from 0.18.0-rc1 until 1.17.0.