{"affected":[{"ranges":[{"events":[{"introduced":"d13f27ee80aae7a521d2e9433c4deaf53f892574"},{"fixed":"d15c981fac6e533d70ac8ee89a6ef4dbf139adc3"},{"fixed":"54bbb2b98af1505b6eed93c45b1936fc76412e5c"}],"repo":"https://github.com/gleam-lang/gleam","type":"GIT"}]}],"aliases":["GHSA-jhcr-c7qm-8589","CVE-2026-103061"],"credits":[{"name":"Peter Ullrich","type":"FINDER"},{"name":"Louis Pilfold","type":"REMEDIATION_DEVELOPER"},{"name":"Eric Meadows-Jönsson","type":"COORDINATOR"},{"name":"Jonatan Männchen / EEF","type":"ANALYST"}],"database_specific":{"capec_ids":["CAPEC-126"],"cpe_ids":["cpe:2.3:a:gleam-lang:gleam:*:*:*:*:*:*:*:*"],"cwe_ids":["CWE-22"]},"details":"## Summary\n\nImproper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in gleam-lang gleam allows a malicious package publisher to delete a directory outside the project's build directory when a developer builds a project.\n\nA Hex package release's metadata carries an `app` field with the release's OTP application name. Gleam reads this field from the hex.pm release API when it downloads dependencies and uses it as the package's build directory name without validating it (`hex_manifest_package` in `compiler-cli/src/dependencies.rs`, `ProjectPaths::build_directory_for_package`). When a dependency fails to compile, Gleam deletes that directory with `remove_dir_all`. hex.pm didn't restrict the field to a directory name before 2026-10-12, so a publisher could set it to a value such as `../../../../target` or an absolute path. When a project depends on such a release directly or transitively and the release fails to compile, `gleam build`, `gleam check`, `gleam run`, `gleam test` or `gleam export` deletes the directory the name resolves to. For a pure Gleam package no publisher code runs.\n\nThis issue affects gleam: from 0.32.4 before 1.19.2.\n\n## Details\n\n1. `hex_manifest_package` (`compiler-cli/src/dependencies.rs`) sets the manifest package's `otp_app` to `meta.app` from `GET packages/<name>/releases/<version>` without validation. hex.pm doesn't restrict this field to a directory name. The signed registry record's dependency `app` label is decoded but never used as a path.\n2. `ManifestPackage::application_name` (`compiler-core/src/manifest.rs`) returns `otp_app` when it is set.\n3. `ProjectPaths::build_directory_for_package` (`compiler-core/src/paths.rs`) joins the application name onto the target's build directory. A `..` component escapes the build directory, and an absolute path replaces the whole path.\n4. When a dependency fails to compile, `ProjectCompiler::load_cache_or_compile_package` (`compiler-core/src/build/project_compiler.rs`) calls `delete_directory` on that path, which runs `std::fs::remove_dir_all` (`compiler-cli/src/fs.rs`).\n5. The manifest built by `download_dependencies` is passed to `build::main` in the same run, so the name reaches compilation without a `manifest.toml` round trip. `otp_app` is validated against `^[a-z][a-z0-9_]*$` only when `manifest.toml` is read from disk (commit 2dc0467, first released in v1.16.0), which rejects a stored malicious manifest on a later run but not the first run that produces it.\n6. Extraction uses the package name, which hex.pm validates, so the effect is a directory delete without an overwrite. For a package with `build_tools = [\"gleam\"]` no publisher code runs, so source that fails to compile or a malformed `gleam.toml` triggers the delete. For rebar3 and Mix dependencies, publisher code runs anyway.\n\n## Proof of concept\n\nNot reproduced end to end, because Gleam only uses hex.pm and has no setting for another repository. A unit test calling `ProjectPaths::build_directory_for_package` with the application names `../../../../canary` and an absolute path computed build directories outside the project, and `std::fs::remove_dir_all`, the call behind `delete_directory`, deleted a canary directory placed there. The chain from `meta.app` to the delete was established by reading the source.\n\n## Impact\n\nA publisher of a package in a project's dependency tree can make a Gleam build delete a directory that the developer's account can write, outside the project's build directory or anywhere on the filesystem when the application name is an absolute path. For a pure Gleam package this happens without running any of the publisher's code. Developers and CI jobs that build projects with Gleam are affected; `gleam deps download` alone isn't.\n\n## Configurations\n\nAffects projects whose dependency tree, directly or transitively, contains a hex.pm package release whose OTP application name is a path, when the project is built with `gleam build`, `gleam check`, `gleam run`, `gleam test` or `gleam export`. `gleam deps download` alone doesn't reach the delete. Gleam only uses hex.pm, which rejects such application names when a release is published since 2026-10-12, so only releases published before then can have one.\n\n## Solutions\n\nUpgrade Gleam to 1.19.2 or later. Gleam then rejects a hex.pm release whose OTP application name, or the application name it gives a dependency, isn't a lowercase letter followed by lowercase letters, digits and `_`.","id":"EEF-CVE-2026-103061","modified":"2026-10-12T18:23:42.039164Z","published":"2026-10-12T18:23:41.507Z","references":[{"type":"ADVISORY","url":"https://github.com/gleam-lang/gleam/security/advisories/GHSA-jhcr-c7qm-8589"},{"type":"WEB","url":"https://cna.erlef.org/cves/CVE-2026-103061.html"},{"type":"WEB","url":"https://github.com/gleam-lang/gleam/commit/d13f27ee80aae7a521d2e9433c4deaf53f892574"},{"type":"FIX","url":"https://github.com/gleam-lang/gleam/commit/d15c981fac6e533d70ac8ee89a6ef4dbf139adc3"},{"type":"FIX","url":"https://github.com/gleam-lang/gleam/commit/54bbb2b98af1505b6eed93c45b1936fc76412e5c"}],"related":[],"schema_version":"1.7.3","severity":[{"score":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","type":"CVSS_V4"}],"summary":"Path traversal in Gleam via unvalidated package application names","upstream":[]}