CVE-2026-77156

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-77156
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-77156.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-77156
Aliases
  • GHSA-9gff-3q53-q75x
Published
2026-10-22T17:44:34Z
Modified
2026-10-23T02:45:23Z
Severity
  • 6.3 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:N/VI:N/VA:N/SC:H/SI:H/SA:H CVSS Calculator
Summary
ast-cli: Path traversal in tar extraction on Linux/macOS allows writes outside the install directory
Details

Incomplete validation of extracted archive entry paths in ast-cli's tar extraction logic on Linux and macOS (used when installing the Vorpal ASCA real-time engine and the SCA Resolver) would allow a malicious tar archive containing absolute or traversal path entries to write files outside the install directory. Windows builds were not affected, as the Windows extractor performs this path validation.

Exploitation required substituting the archive served at "download.checkmarx.com". An attacker able to compromise that server and replace the archive could write arbitrary, executable files to arbitrary filesystem paths via this path traversal.

Extraction now validates that each entry's destination path resolves within the working directory and rejects absolute paths.

Database specific 
{
    "cna_assigner":  "Checkmarx",
    "cwe_ids":  [
        "CWE-22"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/77xxx/CVE-2026-77156.json"
}
References

Affected packages

Git / github.com/checkmarx/ast-cli

Affected ranges

Type
GIT
Repo
https://github.com/checkmarx/ast-cli
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
f933d72a275ba46534e4d621b7afaf0b0479ec4a
Database specific
Show details 
{
    "extracted_events":  [
        {
            "range":  [
                {
                    "introduced":  "0"
                },
                {
                    "fixed":  "2.3.51"
                }
            ],
            "source":  "AFFECTED_FIELD",
            "strategy":  "StandardRange"
        }
    ]
}

Affected versions

1.*
1.0.0_RC5
1.0.65
1.1.1-test-sonar
2.*
2.0.0
2.0.0-nightly
2.0.0-rc.14
2.0.0-rc.16
2.0.0-rc.19
2.0.0-rc.20
2.0.0-rc.21
2.0.0-rc.22
2.0.0-rc.23
2.0.0_RC1
2.0.0_RC10
2.0.0_RC11
2.0.0_RC12
2.0.0_RC13
2.0.0_RC2
2.0.0_RC4
2.0.0_RC5
2.0.0_RC6
2.0.0_RC7
2.0.0_RC8
2.0.0_RC9
2.0.1
2.0.10
2.0.11
2.0.12
2.0.13
2.0.14
2.0.15
2.0.16
2.0.17
2.0.18
2.0.19
2.0.2
2.0.20
2.0.21
2.0.22
2.0.23
2.0.24
2.0.25
2.0.26
2.0.27
2.0.28
2.0.29
2.0.3
2.0.30
2.0.31
2.0.32
2.0.33
2.0.34
2.0.35
2.0.36
2.0.37
2.0.38
2.0.39
2.0.4
2.0.40
2.0.41
2.0.42
2.0.43
2.0.44
2.0.45
2.0.46
2.0.47
2.0.48
2.0.49
2.0.5
2.0.50
2.0.51
2.0.52
2.0.53
2.0.54
2.0.55
2.0.56
2.0.57
2.0.58
2.0.59
2.0.6
2.0.60
2.0.61
2.0.62
2.0.63
2.0.64
2.0.64-sast-chat
2.0.65
2.0.66
2.0.67
2.0.68
2.0.69
2.0.7
2.0.7-PreRelease
2.0.71
2.0.72
2.0.72-prerelease
2.0.73
2.0.73-prerelease
2.0.74
2.0.75
2.0.75-pre-tamar
2.0.75-prerelease
2.0.76
2.0.76-Pre-release
2.0.76-prerelease-2
2.0.8
2.0.9
2.1.0
2.1.1
2.1.2
2.1.3
2.1.4
2.1.5
2.1.6
2.2.0
2.2.1
2.2.2
2.2.3
2.2.4
2.2.5
2.2.6-check-pre-release
2.2.6-vorpal
2.3.10
2.3.11
2.3.12
2.3.13
2.3.14
2.3.15
2.3.15-cloudscan
2.3.16
2.3.16-test
2.3.17
2.3.17-test
2.3.18
2.3.19
2.3.19-traits
2.3.20
2.3.20-remove-ignore-policy
2.3.21
2.3.22
2.3.23
2.3.23-test-oss
2.3.24
2.3.25
2.3.26
2.3.27
2.3.27-Containers.1
2.3.27-MiryamFoifer-Containers
2.3.27-cloud-scan-containers
2.3.28
2.3.29
2.3.29-containers-upgrade
2.3.29-containers-upgrade-01
2.3.30
2.3.30-containers-upgrade
2.3.31
2.3.31-iac-realtime
2.3.32
2.3.32-Remove-filePath-ignore-Final
2.3.33
2.3.34
2.3.35
2.3.36
2.3.36-pre-release-check
2.3.37
2.3.38
2.3.38-iac-realtime
2.3.38-standalone-license-enabled
2.3.41
2.3.42
2.3.43
2.3.43-iac-main-release
2.3.44
2.3.45
2.3.46
2.3.47
2.3.48
2.3.51
2.4.0-TempCleanup
Other
TempCleanup
application-association-prerelease
cli-pre-commit
custom-config-file-main
prerelease-releasefix
standalone-licence-info
test-oss
test-pre
test-sonar
try-pre-release
try-pre-release-tamar
v1.*
v1.0.0
v1.0.0_RC1
v1.0.0_RC2
v1.0.0_RC3
v1.0.0_RC4
v1.10.0

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-77156.json"