CVE-2026-77156 Checkmarx CVE debrief

Who should care

Defenders responsible for the ast-cli installation, particularly those using Linux and macOS, should assess their exposure and verify the integrity of their installation. They should prioritize verifying the integrity of the ast-cli installation and ensuring that the server at download.checkmarx.com is not compromised.

Why it matters

A path traversal vulnerability in ast-cli's tar extraction logic on Linux and macOS could allow an attacker to write arbitrary files outside the install directory if they can compromise the server hosting the archive at download.checkmarx.com. Defenders should prioritize verifying the integrity of the ast-cli installation and ensuring that the server at download.checkmarx.com is not compromised.

• An attacker could write arbitrary files outside the install directory, potentially leading to code execution or data tampering.
• The vulnerability requires an attacker to compromise the server hosting the archive at download.checkmarx.com.
• Defenders should verify the integrity of the ast-cli installation and ensure that the server at download.checkmarx.com is not compromised.

Technical summary

The ast-cli's tar extraction logic on Linux and macOS does not properly validate extracted archive entry paths, allowing a malicious tar archive to write files outside the install directory. This vulnerability can be exploited if an attacker can compromise the server hosting the archive at download.checkmarx.com. The vulnerability has been addressed by validating that each entry's destination path resolves within the working directory and rejects absolute paths. The official CVE Program record and NIST NVD detail page offer source-provided CVE metadata and vulnerability assessments.

Defensive priority

Defenders should prioritize verifying the integrity of the ast-cli installation and ensuring that the server at download.checkmarx.com is not compromised.

Recommended defensive actions

• Verify the integrity of the ast-cli installation
• Ensure the server at download.checkmarx.com is not compromised
• Monitor for suspicious activity related to the ast-cli installation
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, including its description, CVSS score, and affected products. The ast-cli's tar extraction logic on Linux and macOS does not properly validate extracted archive entry paths, allowing a malicious tar archive to write files outside the install directory. The official CVE Program record and NIST NVD detail page offer source-provided CVE metadata and vulnerability assessments. The source references provide additional information on the ast-cli GitHub repository and the ast

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.