Path Traversal Vulnerability in Checkmarx's ast-cli on Linux and macOS

CVE-2026-77156

What is CVE-2026-77156?

In Checkmarx's ast-cli tool, a vulnerability exists due to improper validation of extracted archive entry paths during tar extraction on Linux and macOS systems. This flaw enables attackers to craft malicious tar archives containing absolute or traversal path entries, allowing them to potentially write files to unauthorized locations beyond the intended installation directory. Notably, Windows builds are safeguarded as the extractor enforces path validation. To exploit this vulnerability, an attacker would need to compromise the server hosting the archive, such as 'download.checkmarx.com', and substitute the archive with a malicious version, facilitating the execution of arbitrary files at sensitive filesystem paths. Recent updates to extraction processes enhance security by ensuring that only valid paths are accepted.

References