Path Traversal Vulnerability in Gleam Dependency Management

CVE-2026-43965

What is CVE-2026-43965?

A path traversal vulnerability in Gleam's dependency management system allows attackers to delete arbitrary directories on a victim's system. This occurs when unvalidated package keys from the build/packages/packages.toml file are passed to the filesystem via paths.build_packages_package(). Malicious actors can exploit this flaw by crafting a malicious packages.toml file, leading unsuspecting users to execute commands that trigger directory deletions, regardless of whether the paths are absolute or exploit relative traversals. This vulnerability impacts Gleam from version 0.18.0-rc1 up to 1.17.0, posing a significant risk to systems using these affected versions.

References