CVE-2026-103061

A flaw was found in gleam. When downloading dependencies, the build tool uses the application name from package metadata to determine the build directory path without validating it. A malicious package publisher can supply path traversal sequences or an absolute path, causing arbitrary directorie...