CVE-2026-59247: gleam 0.18.0 to before 1.18.0, v0.18.0-elixir to before v1.18.0-elixir, v0.18.0-elixir-slim to before…

Affected technology

gleam · 0.18.0 to before 1.18.0
gleam-lang

gleam · 0.18.0 to before 1.18.0, 8447b78cc844ff4aec44eea23dbd68d1fea11f11 to before c9c0d48c123c8abae6db8dd61b25ccb427ed3d35
gleam-lang

gleam · v0.18.0-elixir to before v1.18.0-elixir, v0.18.0-elixir-slim to before v1.18.0-elixir-slim, v0.18.0-elixir-alpine to before v1.18.0-elixir-alpine, v0.18.0-erlang to before v1.18.0-erlang, v0.18.0-erlang-slim to before v1.18.0-erlang-slim, v0.18.0-erlang-alpine to before v1.18.0-erlang-alpine, v0.18.0-node to before v1.18.0-node, v0.18.0-node-slim to before v1.18.0-node-slim, v0.18.0-node-alpine to before v1.18.0-node-alpine, v1.6.0-scratch to before v1.18.0-scratch
gleam-lang

Component: gleam_cli::dependencies, gleam_cli::dependencies::dependency_manager
Function: gleam_cli::dependencies::lookup_package, gleam_cli::dependencies::dependency_manager::DependencyManager::perform_version_resolution
File: compiler-cli/src/dependencies.rs, compiler-cli/src/dependencies/dependency_manager.rs

Attack conditions (Source advisory, CVSS 4.0): Network (remote) · No privileges required · Passive user interaction

What an attacker can do

Source advisory’s CVSS 4.0 assessment (base score 7.6/10) rates confidentiality and integrity impact as high; availability impact as none. The description does not specify what an attacker can achieve beyond these rated impacts.