Executive brief
The Gleam compiler, used for building applications in the Gleam programming language, contains a vulnerability in how it handles external code dependencies. If a developer downloads a malicious project or uses a compromised dependency, the compiler can be tricked into deleting or overwriting files anywhere on the developer's computer. This could lead to permanent data loss or allow an attacker to take control of the system by modifying sensitive configuration files.
Technical details
A path traversal vulnerability (CWE-22) exists in the Gleam compiler's handling of git dependencies within 'gleam.toml' and 'manifest.toml'. Dependency names are incorporated into filesystem paths without sufficient validation, allowing the use of relative ('../') or absolute paths. When a user runs 'gleam deps download', the compiler performs directory operations (creation and deletion) based on these unsanitized paths. An attacker can exploit this via a malicious direct or transitive git dependency to achieve arbitrary file system modification, which may lead to remote code execution by overwriting sensitive files like git hooks or shell profiles. The issue is fixed in version 1.15.4.
Affected products
- Gleam-lang Gleam 1.9.0-rc1 to 1.15.3, 1.16.0-rc1
Timeline
- 2026-04-11: disclosed
- 2026-04-11: advisory
- 2026-04-12: patched: Final patch applied in version 1.15.4