CVE-2026-42795

Name of the Vulnerable Software and Affected Versions Gleam versions 0.10.0-rc1 through 1.17.0

Description A symlink following issue in the Hex package export allows files outside the project root to be embedded in the generated package tarball. The file collection helpers gleam files, native files, and private files in compiler-cli/src/fs.rs use follow links(true) when walking publishable directories such as src/ and priv/. These paths are then added to the package archive via add path to tar in compiler-cli/src/publish.rs without verifying that the resolved target remains within the project root. An attacker with write access to the project repository can place a symlink in src/ or priv/ pointing to arbitrary files. When a maintainer or CI pipeline executes the commands "gleam publish" or "gleam export hex-tarball", local files readable by the publisher, such as secrets, tokens, or SSH keys, are silently embedded into the published package artifact.

Recommendations Update Gleam to a version later than 1.17.0. Avoid running "gleam publish" or "gleam export hex-tarball" on untrusted projects. Review the contents of src/ and priv/ for unexpected symlinks before publishing. Run publishing commands in a restricted or isolated environment, such as containers.