Gleam CVE-2026-103061

Exploitation requires a chain of specific prerequisites: (1) a malicious Hex package publisher who sets the release metadata app (OTP application name) field to a path-traversal or absolute path value - only possible for releases published to hex.pm before its 2026-10-12 server-side restriction; (2) the victim must depend on that release directly or transitively; and (3) the release must FAIL to compile, since deletion occurs only in Gleam's dependency-failure cleanup path (remove_dir_all on build_directory_for_package). It is further limited by required user interaction - a developer must actively invoke gleam build, check, run, test, or export - and by the affected version window (0.32.4 up to but not including 1.19.2). Impact is bounded to directory deletion (availability); no attacker code executes for a pure Gleam package.

This is a genuine but moderate-priority supply-chain integrity issue, not a critical remote-code-execution flaw. The vendor CVSS 4.0 vector (AV:N/AC:L/AT:P/PR:N/UI:A) scores 5.9 (medium): network-reachable because the malicious metadata arrives via the hex.pm API, requiring no privileges on the victim, but gated by two real constraints - an Attack Requirement (AT:P) and active user interaction (UI:A, the developer must actually run a build). Crucially, impact is availability-only (VC:N/VI:N/VA:H): the bug deletes a directory via remove_dir_all but runs no publisher code for a pure Gleam package, so there is no confidentiality or code-execution impact. No EPSS score, KEV listing, or POC was provided in the input, so exploitation signals are weak: no public exploit identified at time of analysis and no evidence of active exploitation. A mitigating real-world factor not reflected in the base score is that hex.pm restricted the offending app field server-side before 2026-10-12, which closes the primary delivery path for newly published malicious releases even on unpatched Gleam clients. Net: a legitimate flaw worth patching to 1.19.2, but the destructive-yet-non-executing nature, the dependency-on-a-failing-malicious-package precondition, and the upstream hex.pm fix place it well below high-urgency items.

A malicious actor publishes a Hex package whose release metadata sets the OTP app field to a path-traversal value such as ../../../../target or an absolute path, and induces a victim to add it as a direct or transitive dependency. When the developer runs gleam build/check/run/test/export and that dependency fails to compile, Gleam deletes the directory the traversal resolves to instead of just the package's build cache. No public exploit code was identified in the provided data, and for a pure Gleam package no attacker code executes - the damage is limited to directory deletion.