Gleam CVE-2026-43965

Gleam is a statically-typed functional language targeting the BEAM VM and JavaScript runtimes; its CLI manages dependency state via an internal build/packages/packages.toml file that is normally excluded by .gitignore. The vulnerability (CWE-22: Path Traversal) is located in the LocalPackages::read_from_disc function within compiler-cli/src/dependencies.rs. Package name keys deserialized from the TOML map are passed directly to paths.build_packages_package(), which joins the project's build directory with the caller-supplied key to produce a filesystem path; that path is then handed to fs::delete_directory, a wrapper around Rust's std::fs::remove_dir_all. Because remove_dir_all applies no containment check, both absolute paths and relative traversal sequences are silently accepted. The root cause is the complete absence of an input validation layer at the Serde deserialization boundary for map keys. The fix at commit 690ca069817bee5f77a28fc3e360627c1da19291 introduces a custom deserializer (map_with_package_name_keys::deserialize) that rejects any key not matching the pattern [a-z0-9_]+, as confirmed by the added snapshot test which records rejection of '../../stuff' with the error 'expected a package name containing only lowercase letter, numbers, and underscores'. The same deserializer was also applied to the dependencies and dev_dependencies maps in PackageConfig and Manifest, hardening the broader config-parsing surface.