CVE-2026-42795: Gleam 0.10.0-rc1 to before 1.17.0, v0.10.0-rc1-elixir to before v1.17.0-elixir, v0.10.0-rc1-erlang to before…

Affected technology

Gleam · 0.10.0-rc1 to before 1.17.0
Gleam

Gleam · 0.10.0-rc1 to before 1.17.0, c82a2d83bd0c06cafdc196820deb3f89a9b3ff7c to before 6435a5528b9ae0449e2f32be579641ec485f6866
Gleam

Gleam · v0.10.0-rc1-elixir to before v1.17.0-elixir, v0.10.0-rc1-erlang to before v1.17.0-erlang, v0.10.0-rc1-node to before v1.17.0-node, v0.10.0-rc1-node-slim to before v1.17.0-node-slim, v0.10.0-rc1-elixir-slim to before v1.17.0-elixir-slim, v0.10.0-rc1-erlang-slim to before v1.17.0-erlang-slim, v0.10.0-rc1-erlang-alpine to before v1.17.0-erlang-alpine, v0.10.0-rc1-elixir-alpine to before v1.17.0-elixir-alpine, v0.10.0-rc1-node-alpine to before v1.17.0-node-alpine, v0.10.0-rc1-scratch to before v1.17.0-scratch
Gleam

Component: compiler-cli
Function: compiler_cli::fs::gleam_files, compiler_cli::fs::native_files, compiler_cli::fs::private_files, compiler_cli::publish::project_files, compiler_cli::publish::add_path_to_tar
File: compiler-cli/src/fs.rs, compiler-cli/src/publish.rs

Attack conditions (Source advisory, CVSS 4.0): Local · Low privileges required · Active user interaction

What an attacker can do

An attacker with write access to the project repository can place a symlink in src/ or priv/ pointing to an arbitrary file. Source advisory’s CVSS 4.0 assessment (base score 5.1/10) rates confidentiality impact as high; integrity and availability impact as none.