CVE-2026-77156

The ast-cli tool is vulnerable to a path traversal flaw during tar extraction on Linux and macOS platforms. The root cause is incomplete validation of extracted archive entry paths, which can be exploited by a malicious archive containing absolute or traversal path entries to write files outside ...

CVE-2026-77156 ast-cli: Path traversal in tar extraction on Linux/macOS allows writes outside the install directory

Incomplete validation of extracted archive entry paths in ast-cli's tar extraction logic on Linux and macOS used when installing the Vorpal ASCA real-time engine and the SCA Resolver would allow a malicious tar archive containing absolute or traversal path entries to write files outside the insta...