PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-53777 PerryTS CVE debrief

CVE-2026-53777 is a HIGH-severity path traversal vulnerability in Perry, a software that allows a malicious build server to write arbitrary content to any location writable by the running process. The vulnerability is caused by unsanitized path components in the artifact_name field of ArtifactReady WebSocket messages. Attackers controlling the server URL can deliver traversal payloads through the artifact_name or download_path fields, causing the client to overwrite sensitive files or expose arbitrary local files to an attacker-accessible location.

Vendor
PerryTS
Product
perry
CVSS
HIGH 8.6
CISA KEV
Not listed in stored evidence
Original CVE published
2026-06-11
Original CVE updated
2026-07-14
Advisory published
2026-06-11
Advisory updated
2026-07-14

Who should care

Users of Perry before version 0.5.1159 should update to the latest version to mitigate this vulnerability. Additionally, administrators and security teams responsible for software supply chain security should be aware of this vulnerability and take necessary precautions to prevent exploitation.

Technical summary

The vulnerability is caused by a lack of proper sanitization of path components in the artifact_name field of ArtifactReady WebSocket messages. This allows a malicious build server to write arbitrary content to any location writable by the running process. The vulnerability has a CVSS score of 8.6 and is classified as HIGH severity.

Defensive priority

HIGH

Recommended defensive actions

  • Update Perry to version 0.5.1159 or later.
  • Restrict access to the build server and WebSocket connections.
  • Monitor for suspicious activity and implement additional security measures to prevent exploitation.

Evidence notes

The vulnerability was reported by Vulncheck and is tracked under CVE-2026-53777. The Perry project has released a patch for the vulnerability in version 0.5.1159.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-53777 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-53777

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-53777 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-53777

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.