Improper Path Validation in Gleam Compiler Affects File System Security

CVE-2026-32146

What is CVE-2026-32146?

An improper path validation vulnerability in the Gleam compiler allows an attacker to manipulate filesystem paths during the handling of git dependencies. This occurs when dependency names are integrated into filesystem paths without adequate validation, enabling potential exploitation through relative and absolute path traversal techniques. By leveraging malicious dependencies, an attacker may modify or delete directories beyond the intended scope, leading to data loss or even unauthorized code execution in certain configurations. Such vulnerabilities underscore the need for secure dependency management practices.

References