CVE-2026-55100

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2026-55100

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-55100.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2026-55100

Aliases

GHSA-g956-2f74-rmv7

Published

2026-07-31T17:03:41.858Z

Modified

2026-08-01T03:47:06.732045238Z

Severity

8.7 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N CVSS Calculator

Summary

hashi-vault-js has a path traversal and query parameter injection

Details

hashi-vault-js is a Node.js module for interacting with the HashiCorp Vault API. Prior to 0.5.2, src/Vault.js concatenates unencoded identifier values including name, username, group, role, and version into Vault request paths and query strings instead of using encodeURIComponent() and URLSearchParams, allowing path traversal and query parameter injection. This issue is fixed in version 0.5.2.

Database specific

{
    "cwe_ids": [
        "CWE-23",
        "CWE-74"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/55xxx/CVE-2026-55100.json",
    "cna_assigner": "GitHub_M"
}

References

Affected packages

Git / github.com/kyndryl-open-source/hashi-vault-js

Affected ranges

Type

GIT

Repo

https://github.com/kyndryl-open-source/hashi-vault-js

Events

Introduced

Fixed

0c82c8173214c988d50096a1e61a29ea7b6988af

Database specific

{
    "source": "AFFECTED_FIELD",
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "0.5.2"
        }
    ]
}

Affected versions

0.*

0.5.1

v0.*

v0.5.0

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-55100.json"