Symlink Following Vulnerability in Gleam's Hex Package Export

CVE-2026-42795

What is CVE-2026-42795?

A symlink following vulnerability exists in Gleam's Hex package export feature, which allows an attacker with write access to the project repository to exploit it. By placing a symlink in the publishable directories, such as src/ or priv/, the attacker can reference files outside the project root. When a maintainer or CI pipeline executes the gleam publish or gleam export hex-tarball commands, local files that are readable by the publisher—including sensitive information like secrets, tokens, or SSH keys—can be inadvertently included in the generated package artifact. This exploitation makes it crucial for developers to validate and sanitize file paths during the packaging process.

References