CVE-2026-77157 debrief based on the supplied source corpus. The vulnerability involves ast-cli downloading and executing helper binaries without integrity checks, allowing an attacker to substitute the served archive with an arbitrary binary. This could lead to code execution on developer machines or CI pipelines. The fix involves verifying the download against a published SHA-256 checksum before extracti [truncated]
A path traversal vulnerability in ast-cli's tar extraction logic on Linux and macOS could allow an attacker to write arbitrary files outside the install directory if they can compromise the server hosting the archive at download.checkmarx.com. This vulnerability requires an attacker to substitute the archive served at download.checkmarx.com. An attacker able to compromise that server and replace the archi [truncated]
