{"id":"CVE-2026-42795","aliases":["EEF-CVE-2026-42795","EUVD-2026-33928","GHSA-qhh5-fg4c-8gqc","openSUSE-SU-2026:10953-1","openSUSE-SU-2026:21143-1"],"status":"published","title":"Symlink Following in Hex Package Export Allows Embedding Files Outside Project Root","description":"Symlink following vulnerability in Gleam's Hex package export allows files outside the project root to be embedded in the generated package tarball.\n\nThe file collection helpers (gleam_files, native_files, private_files) in compiler-cli/src/fs.rs use follow_links(true) when walking publishable directories such as src/ and priv/. The collected paths are added to the package archive via add_path_to_tar in compiler-cli/src/publish.rs without verifying that the resolved target remains within the project root. A symlink placed under a publishable directory will cause gleam export hex-tarball or gleam publish to embed the contents of the symlink target into the generated Hex package.\n\nAn attacker with write access to the project repository can place a symlink in src/ or priv/ pointing to an arbitrary file. When a maintainer or CI pipeline runs gleam publish or gleam export hex-tarball, local files readable by the publisher (such as secrets, tokens, or SSH keys) are silently embedded into the published package artifact.\n\nThis issue affects gleam: from 0.10.0-rc1 before 1.17.0.","severity":{"version":"4.0","score":5.1,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.00199,"percentile":0.09826,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-59"],"published":"2026-06-02T13:41:39Z","modified":"2026-11-11T10:47:30Z","affected":[{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"gleam","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.17.0-1.1"}]}],"bundled":3},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"gleam","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.17.0-bp160.1.1"}]}],"bundled":3}],"products":[{"vendor":"gleam","product":"gleam"}],"references":[{"url":"https://github.com/gleam-lang/gleam/security/advisories/GHSA-qhh5-fg4c-8gqc","tags":["vendor-advisory","related","exploit","advisory"]},{"url":"https://cna.erlef.org/cves/CVE-2026-42795.html","tags":["related","web"]},{"url":"https://osv.dev/vulnerability/EEF-CVE-2026-42795","tags":["related","web"]},{"url":"https://github.com/gleam-lang/gleam/commit/c82a2d83bd0c06cafdc196820deb3f89a9b3ff7c","tags":["related","fix","web"]},{"url":"https://github.com/gleam-lang/gleam/commit/6435a5528b9ae0449e2f32be579641ec485f6866","tags":["patch","fix"]},{"url":"https://ghcr.io","tags":["web"]},{"url":"https://github.com","tags":["web"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/42xxx/CVE-2026-42795.json","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-42795","tags":["advisory"]},{"url":"https://github.com/gleam-lang/gleam","tags":["package"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2026-32685","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-42795","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43965","tags":["web"]},{"url":"https://bugzilla.suse.com/1267396","tags":["report"]},{"url":"https://bugzilla.suse.com/1267397","tags":["report"]},{"url":"https://bugzilla.suse.com/1267398","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2026-42795","title":"Symlink Following in Hex Package Export Allows Embedding Files Outside Project Root","description":"Symlink following vulnerability in Gleam's Hex package export allows files outside the project root to be embedded in the generated package tarball.\n\nThe file collection helpers (gleam_files, native_files, private_files) in compiler-cli/src/fs.rs use follow_links(true) when walking publishable directories such as src/ and priv/. The collected paths are added to the package archive via add_path_to_tar in compiler-cli/src/publish.rs without verifying that the resolved target remains within the project root. A symlink placed under a publishable directory will cause gleam export hex-tarball or gleam publish to embed the contents of the symlink target into the generated Hex package.\n\nAn attacker with write access to the project repository can place a symlink in src/ or priv/ pointing to an arbitrary file. When a maintainer or CI pipeline runs gleam publish or gleam export hex-tarball, local files readable by the publisher (such as secrets, tokens, or SSH keys) are silently embedded into the published package artifact.\n\nThis issue affects gleam: from 0.10.0-rc1 before 1.17.0.","status":"published","published":"2026-06-02T13:41:39.527Z","modified":"2026-11-10T19:18:49.163Z","cvss":[{"version":"4.0","score":5.1,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N","level":"medium","assessor":"cna"}],"cwes":["CWE-59"],"updated_at":"2026-11-10T22:18:27.383863Z"}],"euvd":[{"id":"EUVD-2026-33928","description":"Symlink following vulnerability in Gleam's Hex package export allows files outside the project root to be embedded in the generated package tarball.\n\nThe file collection helpers (gleam_files, native_files, private_files) in compiler-cli/src/fs.rs use follow_links(true) when walking publishable directories such as src/ and priv/. The collected paths are added to the package archive via add_path_to_tar in compiler-cli/src/publish.rs without verifying that the resolved target remains within the project root. A symlink placed under a publishable directory will cause gleam export hex-tarball or gleam publish to embed the contents of the symlink target into the generated Hex package.\n\nAn attacker with write access to the project repository can place a symlink in src/ or priv/ pointing to an arbitrary file. When a maintainer or CI pipeline runs gleam publish or gleam export hex-tarball, local files readable by the publisher (such as secrets, tokens, or SSH keys) are silently embedded into the published package artifact.\n\nThis issue affects gleam: from 0.10.0-rc1 before 1.17.0.","status":"published","published":"2026-06-02T13:41:39Z","modified":"2026-11-10T19:18:49Z","cvss":[{"version":"4.0","score":5.1,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N","level":"medium"}],"updated_at":"2026-11-10T20:23:05.996887Z"}],"nvd":[{"id":"CVE-2026-42795","description":"Symlink following vulnerability in Gleam's Hex package export allows files outside the project root to be embedded in the generated package tarball.\n\nThe file collection helpers (gleam_files, native_files, private_files) in compiler-cli/src/fs.rs use follow_links(true) when walking publishable directories such as src/ and priv/. The collected paths are added to the package archive via add_path_to_tar in compiler-cli/src/publish.rs without verifying that the resolved target remains within the project root. A symlink placed under a publishable directory will cause gleam export hex-tarball or gleam publish to embed the contents of the symlink target into the generated Hex package.\n\nAn attacker with write access to the project repository can place a symlink in src/ or priv/ pointing to an arbitrary file. When a maintainer or CI pipeline runs gleam publish or gleam export hex-tarball, local files readable by the publisher (such as secrets, tokens, or SSH keys) are silently embedded into the published package artifact.\n\nThis issue affects gleam: from 0.10.0-rc1 before 1.17.0.","status":"published","published":"2026-06-02T14:16:53.883Z","modified":"2026-11-10T20:19:11.663Z","cvss":[{"version":"4.0","score":5.1,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"medium","assessor":"secondary"}],"cwes":["CWE-59"],"updated_at":"2026-11-10T22:21:28.199856Z"}],"osv":[{"id":"CVE-2026-42795","title":"Symlink Following in Hex Package Export Allows Embedding Files Outside Project Root","description":"Symlink following vulnerability in Gleam's Hex package export allows files outside the project root to be embedded in the generated package tarball.\n\nThe file collection helpers (gleam_files, native_files, private_files) in compiler-cli/src/fs.rs use follow_links(true) when walking publishable directories such as src/ and priv/. The collected paths are added to the package archive via add_path_to_tar in compiler-cli/src/publish.rs without verifying that the resolved target remains within the project root. A symlink placed under a publishable directory will cause gleam export hex-tarball or gleam publish to embed the contents of the symlink target into the generated Hex package.\n\nAn attacker with write access to the project repository can place a symlink in src/ or priv/ pointing to an arbitrary file. When a maintainer or CI pipeline runs gleam publish or gleam export hex-tarball, local files readable by the publisher (such as secrets, tokens, or SSH keys) are silently embedded into the published package artifact.\n\nThis issue affects gleam: from 0.10.0-rc1 before 1.17.0.","status":"published","published":"2026-06-02T13:41:39.527Z","modified":"2026-11-11T10:47:30.129644017Z","cvss":[{"version":"4.0","score":5.1,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N","level":"medium"}],"cwes":["CWE-59"],"updated_at":"2026-11-11T11:06:45.459796Z"},{"id":"EEF-CVE-2026-42795","title":"Symlink Following in Hex Package Export Allows Embedding Files Outside Project Root","description":"## Summary\n\nSymlink following vulnerability in Gleam's Hex package export allows files outside the project root to be embedded in the generated package tarball.\n\nThe file collection helpers (`gleam_files`, `native_files`, `private_files`) in `compiler-cli/src/fs.rs` use `follow_links(true)` when walking publishable directories such as `src/` and `priv/`. The collected paths are added to the package archive via `add_path_to_tar` in `compiler-cli/src/publish.rs` without verifying that the resolved target remains within the project root. A symlink placed under a publishable directory will cause `gleam export hex-tarball` or `gleam publish` to embed the contents of the symlink target into the generated Hex package.\n\nAn attacker with write access to the project repository can place a symlink in `src/` or `priv/` pointing to an arbitrary file. When a maintainer or CI pipeline runs `gleam publish` or `gleam export hex-tarball`, local files readable by the publisher (such as secrets, tokens, or SSH keys) are silently embedded into the published package artifact.\n\nThis issue affects gleam: from 0.10.0-rc1 before 1.17.0.\n\n## Workarounds\n\n* Avoid running `gleam publish` or `gleam export hex-tarball` on untrusted projects\n* Review the contents of `src/` and `priv/` for unexpected symlinks before publishing\n* Run publishing commands in a restricted or isolated environment (e.g. containers)","status":"published","published":"2026-06-02T13:41:39.527Z","modified":"2026-11-10T19:30:02.803302058Z","cvss":[{"version":"4.0","score":5.1,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N","level":"medium"}],"cwes":["CWE-59"],"updated_at":"2026-11-10T19:36:39.929043Z"},{"id":"openSUSE-SU-2026:10953-1","title":"gleam-1.17.0-1.1 on GA media","description":"These are all security issues fixed in the gleam-1.17.0-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-06-04T00:00:00Z","modified":"2026-06-05T10:45:56.543677446Z","updated_at":"2026-11-02T16:58:38.95195Z"},{"id":"openSUSE-SU-2026:21143-1","title":"Security update for gleam","description":"This update for gleam fixes the following issues:\n\nChanges in gleam:\n\n- Update to 1.17.0:\n  * Fixed security vulnerabilities:\n    - Restrict custom documentation page `path` and `source` values so\n      `gleam docs build` cannot escape the docs output directory or project\n      root (bsc#1267396, CVE-2026-32685)\n    - Restrict publication tarball creation so they cannot contain files\n      from outside the project root (bsc#1267397, CVE-2026-42795)\n    - Stricter deserialisation rules for files internal the build directory\n      to reject corrupted data (bsc#1267398, CVE-2026-43965)\n  * All features and bug fixes are extensively highlighted with\n    examples in the upstream blog post at\n    https://gleam.run/news/single-file-gleam-beam-programs-with-escript/\n    and changelog at\n    https://github.com/gleam-lang/gleam/blob/v1.17.0/CHANGELOG.md some of\n    the highlights include:\n    - Various JavaScript code generation fixes and optimization\n    - Various compiler error handling improvements\n    - Ability to use the `todo` keyword in constants\n    - Improved handling of Git monorepos during package management\n    - Ability to create escripts from Gleam programs\n    - Various language server improvements like reference highlighting,\n      record hovering and code actions\n\n- Update to 1.16.0:\n  * Changelog v1.16.0: https://gleam.run/news/javascript-source-maps/\n\n- Update to 1.15.1:\n  * Changelog v1.12.0: https://gleam.run/news/no-more-dependency-management-headaches/\n  * Changelog v1.13.0: https://gleam.run/news/formalising-external-apis/\n  * Changelog v1.14.0: https://gleam.run/news/the-happy-holidays-2025-release/\n  * Changelog v1.15.0: https://gleam.run/news/upgrading-hex-security/\n\n- Replace deprecated \"disabled\" mode with \"manual\" in _service\n- Update to 1.11.0:\n  * The displaying of internal types in HTML documentation has been\n\timproved\n  * A warning is now emitted when the same module is imported\n\tmultiple times into the same module with different aliases\n  * Fixed a bug where a bit array segment matching on a floating\n\tpoint number would match with NaN or Infinity on the JavaScript\n\ttarget\n  * https://github.com/gleam-lang/gleam/blob/v1.11.1/CHANGELOG.md\n\n- Update to 1.10.0:\n  * Changelog: https://gleam.run/news/global-rename-and-find-references/\n\n- skip unit tests that requires networking upon build\n\n- Update to 1.9.0:\n  * Changelog: https://gleam.run/news/hello-echo-hello-git/\n\n- Update to 1.8.1:\n * Fixed a metadata caching bug where accessors for opaque types\n   could sometimes be used in other modules. (Louis Pilfold)\n * Changelog: https://gleam.run/news/gleam-gets-rename-variable/\n\n- Update to 1.7.0:\n * Changelog: https://gleam.run/news/improved-performance-and-publishing/\n\n- Update to 1.6.3:\n * Fixed a bug where Gleam would be unable to compile to BEAM\n   bytecode on older versions of Erlang/OTP. (yoshi)\n\n- Update to 1.6.2:\n * Fixed a bug where patterns in use expressions would not be checked\n   to ensure that they were exhaustive. (Surya Rose)\n\n- Update to 1.6.1:\n * fix update use_manifest logic (Jason Sipula)\n * 1.6.0 Changelog: https://gleam.run/news/context-aware-compilation/\n","status":"published","published":"2026-06-23T09:40:09Z","modified":"2026-06-30T18:24:44.864495883Z","updated_at":"2026-11-02T16:58:41.885092Z"}]}}