Path Traversal Vulnerability in Gleam Language

CVE-2026-103061

What is CVE-2026-103061?

A vulnerability in Gleam allows an attacker to exploit improper validation of directory paths, leading to the potential deletion of directories outside the designated project. The flaw occurs when Gleam processes metadata from the Hex package manager without ensuring it conforms to valid directory names. As a result, malicious actors can set directory names pointing to sensitive locations, which may be deleted if project dependencies do not compile. This security issue affects Gleam versions from 0.32.4 up to, but not including, 1.19.2, highlighting the need for developers to be vigilant about dependency security and to update their Gleam installations.

References