All vulnerabilities
CVE-2026-77156GHSA-9gff-3q53-q75x

github.com/checkmarx/ast-cli: ast-cli: Path traversal in tar extraction on Linux/macOS allows writes outside the install directory

Checkmarx github.com/checkmarx/ast-cli
Open in ThreatlineRecord JSON
CVSS
6.4Medium
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.35%Chance of exploitation activity in the next 30 days, higher than 27% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in2.3.51Fixed versionCVE List
Published22 Oct 2026Updated 22 Oct 2026CVE List

What fixes it

  • 2.3.51github.com/checkmarx/ast-cliCVE List
  • 2.3.51github.com/checkmarx/ast-cli, goGitHubgo get github.com/checkmarx/ast-cli@v2.3.51

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

Incomplete validation of extracted archive entry paths in ast-cli's tar extraction logic on Linux and macOS (used when installing the Vorpal ASCA real-time engine and the SCA Resolver) would allow a malicious tar archive containing absolute or traversal path entries to write files outside the install directory. Windows builds were not affected, as the Windows extractor performs this path validation.

Exploitation required substituting the archive served at "download.checkmarx.com". An attacker able to compromise that server and replace the archive could write arbitrary, executable files to arbitrary filesystem paths via this path traversal.

Extraction now validates that each entry's destination path resolves within the working directory and rejects absolute paths.

Text from GitHub Advisory Database

Affected versions 3

  • github.com/checkmarx/ast-cliaffected: all versions before 2.3.51CVE List
  • github.com/checkmarx/ast-cliunaffected: 2.3.51CVE List
  • github.com/checkmarx/ast-cli, go< 2.3.51GitHub

References 2