CVE-2026-103061 Gleam CVE debrief

Who should care

Developers using Gleam should verify their project's dependencies and ensure they are using version 1.19.2 or later. They should also review their project's build directory and verify that it is not vulnerable to deletion. Additionally, operators and security teams should be aware of the potential disruption to development and deployment workflows and take necessary precautions to mitigate the impact of this vulnerability. Vulnerability management teams, 3

Why it matters

A path traversal vulnerability in Gleam allows a malicious package publisher to delete directories outside the project's build directory when a developer builds a project. Developers should verify their project's dependencies and ensure they are using version 1.19.2 or later.

• Deletion of directories outside the project's build directory
• Potential disruption to development and deployment workflows
• Need for verification of project dependencies and Gleam version

Technical summary

The vulnerability is caused by Gleam's lack of validation for package application names, which allows a malicious publisher to delete directories outside the project's build directory. The issue affects Gleam versions from 0.32.4 before 1.19.2. This vulnerability can be exploited when a dependency fails to compile, and Gleam deletes the directory with remove_dir_all. The directory name is derived from the app field in the Hex package release's metadata, which was not restricted to a directory name before 2026-10-12.

Defensive priority

Developers using Gleam should verify their project's dependencies and ensure they are using version 1.19.2 or later. They should also review their project's build directory and verify that it is not vulnerable to deletion.

Recommended defensive actions

• Verify project dependencies and ensure version 1.19.2 or later
• Review project build directory for vulnerability
• Update Gleam to version 1.19.2 or later
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The vulnerability is caused by Gleam's lack of validation for package application names, which allows a malicious publisher to delete directories outside the project's build directory. The issue is fixed in Gleam version 1.19.2.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.