CVE-2026-32685: Gleam 1.16.0 to before 1.17.0, v1.16.0-elixir to before v1.17.0-elixir, v1.16.0-erlang to before v1.17.0-erlang…

Affected technology

Gleam · 1.16.0 to before 1.17.0
Gleam

Gleam · 1.16.0 to before 1.17.0, 61ed8deb6572b5591ad17d6302c1a38607522f16 to before 81570611906b6b0039c948037094d09a68700f3a
Gleam

Gleam · v1.16.0-elixir to before v1.17.0-elixir, v1.16.0-erlang to before v1.17.0-erlang, v1.16.0-node to before v1.17.0-node, v1.16.0-node-slim to before v1.17.0-node-slim, v1.16.0-elixir-slim to before v1.17.0-elixir-slim, v1.16.0-erlang-slim to before v1.17.0-erlang-slim, v1.16.0-erlang-alpine to before v1.17.0-erlang-alpine, v1.16.0-elixir-alpine to before v1.17.0-elixir-alpine, v1.16.0-node-alpine to before v1.17.0-node-alpine, v1.16.0-scratch to before v1.17.0-scratch
Gleam

Component: compiler-core, compiler-cli
Function: compiler_cli::docs::build_project, compiler_core::docs::generate_html
File: compiler-core/src/config.rs, compiler-core/src/docs.rs, compiler-cli/src/docs.rs, compiler-cli/src/fs.rs

Attack conditions (Source advisory, CVSS 4.0): Local · No privileges required · Active user interaction

What an attacker can do

Source advisory’s CVSS 4.0 assessment (base score 4.6/10) rates confidentiality and integrity impact as low; availability impact as none. The description does not specify what an attacker can achieve beyond these rated impacts.