CVE-2026-103061

Name of the Vulnerable Software and Affected Versions gleam versions 0.32.4 through 1.19.1

Description A path traversal issue exists where a malicious package publisher can cause the deletion of directories outside the project build directory. This occurs because Gleam reads the app field from the hex.pm release API and uses it as the package build directory name without proper validation. If a dependency fails to compile, Gleam uses the remove dir all function to delete the directory associated with that name. A publisher could set the app field to an absolute path or a relative path containing .. components to target arbitrary directories. This can be triggered by commands such as gleam build, gleam check, gleam run, gleam test, or gleam export when a project depends on a malicious release. The issue is specifically linked to the hex manifest package function in compiler-cli/src/dependencies.rs and the ProjectPaths::build directory for package function.

Recommendations Upgrade gleam to version 1.19.2 or later.