Executive brief
Perry, a build and publishing tool, is vulnerable to a security flaw where a malicious build server can trick the software into writing files to unauthorized locations on a user's computer. This could allow an attacker to overwrite sensitive system files or steal private data like SSH keys or cloud credentials. The risk is highest for automated systems like CI/CD pipelines that might connect to a compromised server without a manual confirmation prompt.
Technical details
A path traversal vulnerability exists in the 'perry publish' command due to insufficient sanitization of the 'artifact_name' and 'download_path' fields in ArtifactReady WebSocket messages. The application uses PathBuf::join to construct local destination paths, which does not normalize '..' components or reject absolute paths. An attacker controlling a build server (or via a malicious perry.toml configuration) can trigger an arbitrary file write by supplying traversal sequences in 'artifact_name'. Additionally, for self-hosted hubs, an attacker can exploit 'download_path' to perform an arbitrary local file read by copying sensitive files into the output directory. This is fixed in version 0.5.1159 by implementing path sanitization and restricting local-copy shortcuts to loopback addresses.
Affected products
- PerryTS Perry < 0.5.1159
Timeline
- 2026-06-11: disclosed
- 2026-06-11: patched: Fixed in version 0.5.1159
- 2026-06-11: advisory
References
- https://github.com/PerryTS/perry/commit/95e1043df8081f67038bffce847dd9ddb3dae046
- https://github.com/PerryTS/perry/pull/4989
- https://github.com/PerryTS/perry/releases/tag/v0.5.1159
- https://github.com/PerryTS/perry/security/advisories/GHSA-x55v-q459-68ch
- https://www.vulncheck.com/advisories/perry-path-traversal-via-artifactready-websocket