THREAT OPS › Threat News › [NVD] CVE-2026-43965 — Path traversal vulnerability in Gleam's dependency management allows arbitrary directory deletion via malicious build/packages/packages.toml content.
Package keys read from build/packages/packages.toml by LocalPackages::read_from_disc are passed without validation to paths.build
[NVD] CVE-2026-43965 — Path traversal vulnerability in Gleam's dependency management allows arbitrary directory deletion via malicious build/packages/packages.toml content. Package keys read from build/packages/packages.toml by LocalPackages::read_from_disc are passed without validation to paths.build
CVE-2026-43965 CVSS: None Published: 2026-06-02T14:16:54.053
Path traversal vulnerability in Gleam's dependency management allows arbitrary directory deletion via malicious build/packages/packages.toml content.
Package keys read from build/packages/packages.toml by LocalPackages::read_from_disc are passed without validation to paths.build_packages_package(), which constructs a filesystem path b
Indicators of compromise
- CVE-2026-43965cve
Original source: https://nvd.nist.gov/vuln/detail/CVE-2026-43965