CVE-2026-42795

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-42795
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-42795.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-42795
Aliases
Downstream
Related
Published
2026-06-02T13:41:39Z
Modified
2026-09-09T03:30:21Z
Severity
  • 5.1 (Medium) CVSS_V4 - CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N CVSS Calculator
Summary
Symlink Following in Hex Package Export Allows Embedding Files Outside Project Root
Details

Symlink following vulnerability in Gleam's Hex package export allows files outside the project root to be embedded in the generated package tarball.

The file collection helpers (gleam_files, native_files, private_files) in compiler-cli/src/fs.rs use follow_links(true) when walking publishable directories such as src/ and priv/. The collected paths are added to the package archive via add_path_to_tar in compiler-cli/src/publish.rs without verifying that the resolved target remains within the project root. A symlink placed under a publishable directory will cause gleam export hex-tarball or gleam publish to embed the contents of the symlink target into the generated Hex package.

An attacker with write access to the project repository can place a symlink in src/ or priv/ pointing to an arbitrary file. When a maintainer or CI pipeline runs gleam publish or gleam export hex-tarball, local files readable by the publisher (such as secrets, tokens, or SSH keys) are silently embedded into the published package artifact.

This issue affects Gleam from 0.10.0-rc1 until 1.17.0.

Database specific 
{
    "cna_assigner": "EEF",
    "cwe_ids": [
        "CWE-59"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/42xxx/CVE-2026-42795.json",
    "unresolved_ranges": [
        {
            "extracted_events": [
                {
                    "introduced": "c82a2d83bd0c06cafdc196820deb3f89a9b3ff7c"
                },
                {
                    "fixed": "6435a5528b9ae0449e2f32be579641ec485f6866"
                }
            ],
            "source": "AFFECTED_FIELD"
        }
    ]
}
References

Affected packages

Git / github.com/gleam-lang/gleam

Affected ranges

Type
GIT
Repo
https://github.com/gleam-lang/gleam
Events
Introduced
b257d55b33ff75515f9ed7d2a670e73c4aaaef91
Fixed
6435a5528b9ae0449e2f32be579641ec485f6866
Database specific
Show details 
{
    "extracted_events": [
        {
            "introduced": "0.10.0-rc1"
        },
        {
            "fixed": "1.17.0"
        },
        {
            "introduced": "v0.10.0-rc1-elixir"
        },
        {
            "fixed": "v1.17.0-elixir"
        },
        {
            "introduced": "v0.10.0-rc1-erlang"
        },
        {
            "fixed": "v1.17.0-erlang"
        },
        {
            "introduced": "v0.10.0-rc1-node"
        },
        {
            "fixed": "v1.17.0-node"
        },
        {
            "introduced": "v0.10.0-rc1-node-slim"
        },
        {
            "fixed": "v1.17.0-node-slim"
        },
        {
            "introduced": "v0.10.0-rc1-elixir-slim"
        },
        {
            "fixed": "v1.17.0-elixir-slim"
        },
        {
            "introduced": "v0.10.0-rc1-erlang-slim"
        },
        {
            "fixed": "v1.17.0-erlang-slim"
        },
        {
            "introduced": "v0.10.0-rc1-erlang-alpine"
        },
        {
            "fixed": "v1.17.0-erlang-alpine"
        },
        {
            "introduced": "v0.10.0-rc1-elixir-alpine"
        },
        {
            "fixed": "v1.17.0-elixir-alpine"
        },
        {
            "introduced": "v0.10.0-rc1-node-alpine"
        },
        {
            "fixed": "v1.17.0-node-alpine"
        },
        {
            "introduced": "v0.10.0-rc1-scratch"
        },
        {
            "fixed": "v1.17.0-scratch"
        }
    ],
    "source": [
        "AFFECTED_FIELD",
        "REFERENCES"
    ]
}

Affected versions

Other
nightly
v0.*
v0.10.0
v0.10.0-rc1
v0.10.0-rc2
v0.10.1
v0.11.0
v0.11.0-rc1
v0.11.0-rc2
v0.11.0-rc3
v0.11.1
v0.11.2
v0.12.0
v0.12.0-rc3
v0.12.0-rc4
v0.12.1
v0.13.0
v0.13.0-rc1
v0.13.0-rc2
v0.13.1
v0.13.2
v0.14.0
v0.14.0-rc1
v0.14.0-rc2
v0.14.1
v0.14.2
v0.14.3
v0.14.4
v0.15.0
v0.15.0-rc1
v0.15.1
v0.16.0
v0.16.0-rc1
v0.16.0-rc2
v0.16.0-rc3
v0.16.0-rc4
v0.16.1
v0.17.0
v0.17.0-rc1
v0.17.0-rc2
v0.18.0
v0.18.0-rc1
v0.18.0-rc2
v0.18.0-rc3
v0.18.1
v0.18.2
v0.19.0
v0.19.0-rc1
v0.19.0-rc2
v0.19.0-rc3
v0.19.0-rc4
v0.20.0
v0.20.0-rc1
v0.20.1
v0.21.0
v0.21.0-rc1
v0.21.0-rc2
v0.22.0
v0.22.0-rc1
v0.22.1
v0.23.0
v0.23.0-rc1
v0.23.0-rc2
v0.24.0
v0.24.0-rc1
v0.24.0-rc2
v0.24.0-rc3
v0.24.0-rc4
v0.25.0
v0.25.0-rc1
v0.25.0-rc2
v0.25.1
v0.25.2
v0.25.3
v0.26.0
v0.26.0-rc1
v0.26.1
v0.26.2
v0.27.0
v0.27.0-rc1
v0.28.0
v0.28.0-rc1
v0.28.0-rc2
v0.28.0-rc3
v0.28.1
v0.28.2
v0.28.3
v0.29.0
v0.29.0-rc1
v0.29.0-rc2
v0.30.0
v0.30.0-rc1
v0.30.0-rc2
v0.30.0-rc3
v0.30.0-rc4
v0.30.1
v0.30.2
v0.30.3
v0.30.4
v0.30.5
v0.31.0
v0.31.0-rc1
v0.32.0
v0.32.0-rc1
v0.32.0-rc2
v0.32.0-rc3
v0.32.1
v0.32.2
v0.32.3
v0.32.4
v0.33.0
v0.33.0-rc1
v0.33.0-rc2
v0.33.0-rc3
v0.33.0-rc4
v0.34.0
v0.34.0-rc1
v0.34.0-rc2
v0.34.1
v1.*
v1.0.0
v1.0.0-rc1
v1.0.0-rc2
v1.1.0
v1.1.0-rc1
v1.1.0-rc2
v1.1.0-rc3
v1.10.0
v1.10.0-rc1
v1.11.0
v1.11.0-rc1
v1.11.0-rc2
v1.11.1
v1.12.0
v1.12.0-rc1
v1.12.0-rc2
v1.12.0-rc3
v1.13.0
v1.13.0-rc1
v1.13.0-rc2
v1.14.0
v1.14.0-rc1
v1.14.0-rc2
v1.14.0-rc3
v1.15.0
v1.15.0-rc1
v1.15.0-rc2
v1.15.1
v1.16.0
v1.16.0-rc1
v1.16.0-rc2
v1.16.0-rc3
v1.16.0-rc4
v1.17.0-rc1
v1.17.0-rc2
v1.2.0
v1.2.0-rc1
v1.2.0-rc2
v1.2.1
v1.3.0
v1.3.0-rc1
v1.3.0-rc2
v1.3.0-rc3
v1.3.1
v1.3.2
v1.4.0
v1.4.0-rc1
v1.4.1
v1.5.0
v1.5.0-rc1
v1.5.0-rc2
v1.6.0
v1.6.0-rc1
v1.6.0-rc2
v1.6.1
v1.7.0-rc1
v1.7.0-rc2
v1.7.0-rc3
v1.8.0
v1.8.0-rc1
v1.9.0
v1.9.0-rc1
v1.9.0-rc2
v1.9.1

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-42795.json"