CVE-2026-43965: Gleam 0.18.0-rc1 to before 1.17.0, v0.18.0-rc1-elixir to before v1.17.0-elixir, v0.18.0-rc1-erlang to before…

Affected technology

Gleam · 0.18.0-rc1 to before 1.17.0
Gleam

Gleam · 0.18.0-rc1 to before 1.17.0, ed7aec0484f10d60978b63788c8a6497590855ab to before 690ca069817bee5f77a28fc3e360627c1da19291
Gleam

Gleam · v0.18.0-rc1-elixir to before v1.17.0-elixir, v0.18.0-rc1-erlang to before v1.17.0-erlang, v0.18.0-rc1-node to before v1.17.0-node, v0.18.0-rc1-node-slim to before v1.17.0-node-slim, v0.18.0-rc1-elixir-slim to before v1.17.0-elixir-slim, v0.18.0-rc1-erlang-slim to before v1.17.0-erlang-slim, v0.18.0-rc1-erlang-alpine to before v1.17.0-erlang-alpine, v0.18.0-rc1-elixir-alpine to before v1.17.0-elixir-alpine, v0.18.0-rc1-node-alpine to before v1.17.0-node-alpine, v0.18.0-rc1-scratch to before v1.17.0-scratch
Gleam

Component: compiler-cli
Function: compiler_cli::dependencies::remove_extra_packages, compiler_cli::dependencies::LocalPackages::read_from_disc, compiler_cli::dependencies::LocalPackages::extra_local_packages
File: compiler-cli/src/dependencies.rs

Attack conditions (Source advisory, CVSS 4.0): Local · No privileges required · Active user interaction

What an attacker can do

Source advisory’s CVSS 4.0 assessment (base score 5.6/10) rates confidentiality and integrity impact as none; availability impact as high. The description does not specify what an attacker can achieve beyond these rated impacts.