CVE-2026-55100 in hashi-vault-js
Summary
by MITRE • 07/31/2026
hashi-vault-js is a Node.js module for interacting with the HashiCorp Vault API. Prior to 0.5.2, src/Vault.js concatenates unencoded identifier values including name, username, group, role, and version into Vault request paths and query strings instead of using encodeURIComponent() and URLSearchParams, allowing path traversal and query parameter injection. This issue is fixed in version 0.5.2.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 07/31/2026
The hashi-vault-js library presents a critical security vulnerability through its improper handling of identifier values in API requests to HashiCorp Vault. This flaw affects versions prior to 0.5.2 and stems from the concatenation of unencoded parameters directly into request paths and query strings within the src/Vault.js file. The vulnerability manifests when user-provided identifiers such as name, username, group, role, and version are inserted into Vault API endpoints without proper URL encoding mechanisms.
The technical implementation flaw occurs at the HTTP request construction level where the module fails to employ standard security practices for URI encoding. When these identifier values contain special characters that have reserved meanings in URLs, such as forward slashes, question marks, or ampersands, they can be interpreted by the Vault API as part of the URL structure rather than as literal parameter values. This creates opportunities for path traversal attacks where maliciously crafted identifiers could manipulate the intended API endpoint path. The vulnerability aligns with CWE-116 Standard Error Handling and CWE-74 Improper Neutralization of Special Elements in Output Used by a Downstream Component.
The operational impact of this vulnerability extends beyond simple parameter injection to potentially enable unauthorized access patterns within the Vault system. An attacker could exploit this weakness to bypass intended access controls, manipulate API endpoints to target different resources than intended, or even attempt directory traversal attacks against the underlying Vault infrastructure. The vulnerability particularly affects authentication and authorization flows where user identifiers are used in API calls, potentially allowing attackers to escalate privileges or gain access to resources they should not be authorized to access.
This security gap represents a fundamental failure in input sanitization and URL construction practices that violates established security principles for web application development. The fix implemented in version 0.5.2 addresses this by properly applying encodeURIComponent() and utilizing URLSearchParams for constructing request parameters, ensuring that all identifier values are correctly encoded before being incorporated into API requests. Organizations using affected versions should immediately upgrade to 0.5.2 or later to mitigate potential exploitation risks. The vulnerability demonstrates the importance of proper input validation and encoding practices in preventing injection attacks and aligns with ATT&CK technique T1078 Valid Accounts for privilege escalation scenarios that could potentially leverage this weakness.
The remediation approach taken by the maintainers follows industry best practices for preventing URL-related injection vulnerabilities, emphasizing the critical need for proper URI encoding in all external API interactions. This fix ensures that user-supplied identifiers are treated as literal values rather than structural components of the URL, thereby preventing malicious manipulation of API endpoint paths and query parameters. The vulnerability serves as a reminder of the essential security controls required when developing client libraries that interface with sensitive systems like HashiCorp Vault, where improper input handling can lead to significant security implications across the entire infrastructure.