CVE-2026-77156: ast-cli: Path traversal in tar extraction on Linux/macOS allows writes outside the install directory
Incomplete validation of extracted archive entry paths in ast-cli's tar extraction logic on Linux and macOS (used when installing the Vorpal ASCA real-time engine and the SCA Resolver) would allow a malicious tar archive containing absolute or traversal path entries to write files outside the install directory. Windows builds were not affected, as the Windows extractor performs this path validation.
Exploitation would require substituting the archive served at "download.checkmarx.com". An attacker able to compromise that server and replace the archive could write arbitrary, executable files to arbitrary filesystem paths via this path traversal.
Extraction now validates that each entry's destination path resolves within the working directory and rejects absolute paths.
Affected Software
Event History
Frequently Asked Questions
Which systems and installation flows are exposed?
Linux and macOS installations are affected when ast-cli extracts archives used to install the Vorpal ASCA real-time engine or the SCA Resolver. Windows builds are not affected because their extractor validates archive paths.
What must an attacker do to exploit this issue?
The attacker would need to substitute a malicious archive served from download.checkmarx.com, such as by compromising that server. The archive must contain absolute-path or traversal-path entries that escape the intended installation directory.
What is the potential impact of a successful exploit?
A malicious archive could cause arbitrary files, including executable files, to be written to arbitrary filesystem locations accessible to the installation process.
How can I determine whether the archive-path protection is present?
The corrected extraction logic resolves each archive entry destination within the working directory and rejects absolute paths. The provided information does not identify specific affected or fixed ast-cli versions.