CVE-2026-28807

Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability in gleam-wisp wisp allows arbitrary file read via percent-encoded path traversal. The wisp.servestatic function is vulnerable to path traversal because sanitization runs before percent-decoding. The encoded...

CVE-2026-28807

Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability in gleam-wisp wisp allows arbitrary file read via percent-encoded path traversal. The wisp.servestatic function is vulnerable to path traversal because sanitization runs before percent-decoding. The encoded...

PT-2026-24472

Name of the Vulnerable Software and Affected Versions gleam-wisp wisp versions 2.1.1 through 2.2.0 Description A path traversal issue exists in gleam-wisp wisp that allows arbitrary file reading through percent-encoded path traversal. The wisp.serve static function is susceptible because...

CVE-2026-28807: Improper Limitation of a Pathname to a Restricted Directory

Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability in gleam-wisp wisp allows arbitrary file read via percent-encoded path traversal. The wisp.servestatic function is vulnerable to path traversal because sanitization runs before percent-decoding. The encoded...

CVE-2026-28807

creationtimestamp| type| source ---|---|--- 2026-03-09 12:29:02+00:00| published-proof-of-concept| https://github.com/gleam-wisp/wisp/security/advisories/GHSA-h7cj-j2vv-qw8r...

EUVD-2026-2094

Renovate vulnerable to arbitrary command injection via gleam manager and malicious gleam.toml file...

GHSA-XJR7-3C3G-M763 Renovate vulnerable to arbitrary command injection via gleam manager and malicious gleam.toml file

Summary The user-provided string depName in the gleam manager is appended to the gleam deps update command without proper sanitization. Details Adversaries can provide a maliciously crafted gleam.toml in conjunctions with a tweaked Renovate configuration file to trick Renovate to execute arbitrar...

Arbitrary Command Injection

Overview renovate is a dependency updater. Affected versions of this package are vulnerable to Arbitrary Command Injection due to the improper sanitazation of user-supplied depName in the packagesToUpdate functions of gleam manager. An attacker can execute arbitrary commands on the host system by...

Renovate vulnerable to arbitrary command injection via gleam manager and malicious gleam.toml file

Summary The user-provided string depName in the gleam manager is appended to the gleam deps update command without proper sanitization. Details Adversaries can provide a maliciously crafted gleam.toml in conjunctions with a tweaked Renovate configuration file to trick Renovate to execute arbitrar...

Malicious code in test-mlw2-gleam-gnarr (npm)

The package test-mlw2-gleam-gnarr was found to contain malicious code...

MAL-2025-35419 Malicious code in test-mlw2-gleam-gnarr (npm)

The package test-mlw2-gleam-gnarr was found to contain malicious code...

MAL-2025-21564 Malicious code in gleam-murmur-zlz108-project (npm)

The package gleam-murmur-zlz108-project was found to contain malicious code...

MAL-2025-21565 Malicious code in gleam-oak-lka367-project (npm)

The package gleam-oak-lka367-project was found to contain malicious code...

Malicious code in gleam-oak-lka367-project (npm)

The package gleam-oak-lka367-project was found to contain malicious code...

Malicious code in gleam-murmur-zlz108-project (npm)

The package gleam-murmur-zlz108-project was found to contain malicious code...