Is CVE-2026-32146 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-32146 being exploited in the wild.

How severe is CVE-2026-32146?

High severity, with a CVSS score of 7.8, published 11 April 2026.

Which products and versions are affected?

Gleam-lang Gleam 1.9.0-rc1 to 1.15.3, 1.16.0-rc1.

Is there a fix for CVE-2026-32146?

A patch was published on 2026-04-12: Final patch applied in version 1.15.4 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-32146 attacked?

It is attacked with local access, in a software library.

Am I affected by CVE-2026-32146?

Check whether you run Lpil Gleam. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-32146: Gleam compiler path traversal in git dependency handling

CVE-2026-32146 · Severity: high · CVSS 7.8 · Published 2026-04-11

The Gleam compiler, used for building applications in the Gleam programming language, contains a vulnerability in how it handles external code dependencies. If a developer downloads a malicious project or uses a compromised dependency, the compiler can be tricked into deleting or overwriting files anywhere on the developer's computer. This could lead to permanent data loss or allow an attacker to take control of the system by modifying sensitive configuration files.

Technologies: Lpil Gleam. Vendors: Lpil.

Quick answers

Is CVE-2026-32146 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-32146 being exploited in the wild.
How severe is CVE-2026-32146?: High severity, with a CVSS score of 7.8, published 11 April 2026.
Which products and versions are affected?: Gleam-lang Gleam 1.9.0-rc1 to 1.15.3, 1.16.0-rc1.
Is there a fix for CVE-2026-32146?: A patch was published on 2026-04-12: Final patch applied in version 1.15.4 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-32146 attacked?: It is attacked with local access, in a software library.
Am I affected by CVE-2026-32146?: Check whether you run Lpil Gleam. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A path traversal vulnerability (CWE-22) exists in the Gleam compiler's handling of git dependencies within 'gleam.toml' and 'manifest.toml'. Dependency names are incorporated into filesystem paths without sufficient validation, allowing the use of relative ('../') or absolute paths. When a user runs 'gleam deps download', the compiler performs directory operations (creation and deletion) based on these unsanitized paths. An attacker can exploit this via a malicious direct or transitive git dependency to achieve arbitrary file system modification, which may lead to remote code execution by overwriting sensitive files like git hooks or shell profiles. The issue is fixed in version 1.15.4.

Affected products

Gleam-lang Gleam 1.9.0-rc1 to 1.15.3, 1.16.0-rc1

Timeline

2026-04-11: disclosed
2026-04-11: advisory
2026-04-12: patched: Final patch applied in version 1.15.4

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.