THREAT OPS › Threat News › [NVD] CVE-2026-42795 — Symlink following vulnerability in Gleam's Hex package export allows files outside the project root to be embedded in the generated package tarball.
The file collection helpers (gleam_files, native_files, private_files) in compiler-cli/src/fs.rs use follow_links(true) when walki
[NVD] CVE-2026-42795 — Symlink following vulnerability in Gleam's Hex package export allows files outside the project root to be embedded in the generated package tarball. The file collection helpers (gleam_files, native_files, private_files) in compiler-cli/src/fs.rs use follow_links(true) when walki
CVE-2026-42795 CVSS: None Published: 2026-06-02T14:16:53.883
Symlink following vulnerability in Gleam's Hex package export allows files outside the project root to be embedded in the generated package tarball.
The file collection helpers (gleam_files, native_files, private_files) in compiler-cli/src/fs.rs use follow_links(true) when walking publishable directories such as src/ and priv/. The co
Indicators of compromise
- CVE-2026-42795cve
Original source: https://nvd.nist.gov/vuln/detail/CVE-2026-42795