CVE-2026-103061

A flaw was found in gleam. When downloading dependencies, the build tool uses the application name from package metadata to determine the build directory path without validating it. A malicious package publisher can supply path traversal sequences or an absolute path, causing arbitrary directories on the developer's system to be deleted if the package fails to compile during a build operation.

An IMPORTANT severity path traversal flaw was found in the Gleam build tool (gleam). Gleam reads a Hex package release's OTP application name from the hex.pm release API when it downloads dependencies and uses it, without validation, as the package's build directory name. A malicious package publisher could set this publisher-controlled metadata field to path traversal sequences or an absolute path; when a project that depends on such a release directly or transitively is built and the dependency fails to compile, Gleam recursively deletes the directory the name resolves to, allowing deletion of arbitrary directories and files accessible to the user running the build. The deletion is triggered by gleam build, gleam check, gleam run, gleam test, and gleam export, but not by gleam deps download alone, and for a pure Gleam package no publisher code runs. Exploitation requires a developer or CI process to build a project containing a malicious dependency, which is why Red Hat scores this flaw as IMPORTANT with a local attack vector (CVSS 3.1 score 7.1, CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H), whereas the upstream CVEORG record assigns a CVSS 4.0 score of 5.9 (MODERATE), treating the flaw as network-exploitable with attacker participation and user interaction required and impact limited to availability.

Within Red Hat's product scope, gleam is affected as a build-time dependency of gjs in Red Hat Enterprise Linux rhel-br-9 streams and mozjs60 in Red Hat Enterprise Linux 8 streams, of firefox and thunderbird in Red Hat In-Vehicle OS, and of community (Fedora and EPEL) components including icecat, firefox, mozjs115, mozjs128, mozjs140, seamonkey, and thunderbird. firefox and thunderbird as shipped in Red Hat Enterprise Linux 7, 8, 9, and 10 are not affected because the vulnerable gleam component is not present in those builds. Fixes for the affected products are being pursued through the responsible maintainers.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability. Upstream, the issue is fixed in Gleam 1.19.2, which validates the OTP application name used to form dependency build directories; users who build projects with Gleam directly should upgrade to Gleam 1.19.2 or later. Note that hex.pm has rejected application names that are not plain directory names for releases published since 2026-10-12, so only dependency releases published before that date can carry a malicious application name. For affected Red Hat products, updated packages will be provided through the respective product streams.