Vendors / Gleam Records 4 All Threatist records
Exploited (KEV) 0 None in CISA KEV
CVSS critical 0
CVSS high 0
Exploited now Gleam records in CISA KEV No Gleam vulnerabilities are listed in CISA KEV.
Priority MEDIUM 58
Path traversal vulnerability in Gleam's dependency management allows arbitrary directory deletion via malicious build/packages/packages.toml content.
CVSS 4.0 MEDIUM 5.6· Local · No auth · User interaction · EPSS 0.00229 · Published 2026-06-02 · Fixed in 1.17.0, v1.17.0-elixir +9 CWE-22
Priority MEDIUM 56
Symlink following vulnerability in Gleam's Hex package export allows files outside the project root to be embedded in the generated package tarball.
CVSS 4.0 MEDIUM 5.1· Local · Low privileges · User interaction · EPSS 0.00199 · Published 2026-06-02 · Fixed in 1.17.0, v1.17.0-elixir +9 CWE-59
Priority MEDIUM 54
Path traversal vulnerability in Gleam's handling of custom documentation pages allows arbitrary file read and file write outside the intended documentation output directory.
CVSS 4.0 MEDIUM 4.6· Local · No auth · User interaction · EPSS 0.00229 · Published 2026-06-02 · Fixed in 1.17.0, v1.17.0-elixir +9 CWE-22
Priority LOW 27
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in gleam-lang gleam allows a malicious package publisher to delete a directory outside the project's build directory when a dev…
CVSS 4.0 MEDIUM 5.9· Network · No auth · User interaction · EPSS 0.00398 · Published 2026-10-12 · Partial fix · 1.19.2, v1.19.2-elixir +9 CWE-22
Open these records in search → All records by CVSS severity
0 0 4 0 0
THREATIST.IORead the docs