Junglewise Threat Intelligence

CVE-2026-55100: Kyndryl hashi-vault-js path traversal and query injection in Vault.js

CVE-2026-55100 · Severity: high · CVSS 8.7 · Published 2026-07-31

Executive brief

hashi-vault-js is a software library used by developers to connect Node.js applications to HashiCorp Vault, a tool for managing sensitive passwords and encryption keys. A security flaw in this library allows attackers to manipulate web requests if the application uses untrusted user input to look up secrets. This could allow an attacker to access unauthorized areas of the Vault or perform administrative actions using the application's credentials, potentially leading to the exposure of sensitive corporate data.

Technical details

The hashi-vault-js library prior to version 0.5.2 is vulnerable to path traversal and query parameter injection because it lacks proper URI encoding for identifiers such as names, usernames, groups, and roles. In src/Vault.js, these values are concatenated directly into HTTP request paths and query strings without using encodeURIComponent(). An attacker providing crafted input (e.g., '../../sys/seal') can cause the library to access unintended Vault API endpoints or inject malicious query parameters. This allows an attacker to execute operations within the scope of the application's Vault token. The issue is fixed in version 0.5.2 by implementing proper encoding and safe query string formatting.

Affected products

  • Kyndryl hashi-vault-js < 0.5.2

Timeline

  • 2026-06-09: advisory: GitHub Security Advisory published by maintainer
  • 2026-06-10: patched: Version 0.5.2 released with fixes
  • 2026-07-31: disclosed: CVE-2026-55100 published to NVD

References

Related threats