CVE-2026-103061: Gleam 0.32.4 to before 1.19.2, v0.32.4-elixir to before v1.19.2-elixir, v0.32.4-erlang to before v1.19.2-erlang…

Affected technology

Gleam · 0.32.4 to before 1.19.2
Gleam

Gleam · v0.32.4-elixir to before v1.19.2-elixir, v0.32.4-erlang to before v1.19.2-erlang, v0.32.4-node to before v1.19.2-node, v0.32.4-node-slim to before v1.19.2-node-slim, v0.32.4-elixir-slim to before v1.19.2-elixir-slim, v0.32.4-erlang-slim to before v1.19.2-erlang-slim, v0.32.4-erlang-alpine to before v1.19.2-erlang-alpine, v0.32.4-elixir-alpine to before v1.19.2-elixir-alpine, v0.32.4-node-alpine to before v1.19.2-node-alpine, v0.32.4-scratch to before v1.19.2-scratch
Gleam

Gleam · d13f27ee80aae7a521d2e9433c4deaf53f892574 to before *; status changes: d15c981fac6e533d70ac8ee89a6ef4dbf139adc3 — unaffected, 54bbb2b98af1505b6eed93c45b1936fc76412e5c — unaffected
Gleam

Component: gleam_cli::dependencies, gleam_core::manifest, gleam_core::paths, gleam_core::build::project_compiler, gleam_cli::fs
Function: gleam_cli::dependencies::hex_manifest_package, gleam_core::manifest::ManifestPackage::application_name, gleam_core::paths::ProjectPaths::build_directory_for_package, gleam_core::build::project_compiler::ProjectCompiler::load_cache_or_compile_package, gleam_cli::fs::delete_directory
File: compiler-cli/src/dependencies.rs, compiler-core/src/manifest.rs, compiler-core/src/paths.rs, compiler-core/src/build/project_compiler.rs, compiler-cli/src/fs.rs

Attack conditions (Source advisory, CVSS 4.0): Network (remote) · No privileges required · Active user interaction

What an attacker can do

Source advisory’s CVSS 4.0 assessment (base score 5.9/10) rates confidentiality and integrity impact as none; availability impact as high. The description does not specify what an attacker can achieve beyond these rated impacts.