CVE-2026-77156 in Ast-cli
Summary
by MITRE • 10/22/2026
Incomplete validation of extracted archive entry paths in ast-cli's tar extraction logic on Linux and macOS (used when installing the Vorpal ASCA real-time engine and the SCA Resolver) would allow a malicious tar archive containing absolute or traversal path entries to write files outside the install directory. Windows builds were not affected, as the Windows extractor performs this path validation.
Exploitation required substituting the archive served at "download.checkmarx.com". An attacker able to compromise that server and replace the archive could write arbitrary, executable files to arbitrary filesystem paths via this path traversal.
Extraction now validates that each entry's destination path resolves within the working directory and rejects absolute paths.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 10/22/2026
The vulnerability identified in ast-cli involves a critical failure in input validation during the extraction of tar archives on Linux and macOS operating systems. This flaw specifically impacts the installation processes for the Vorpal ASCA real-time engine and the SCA Resolver, which rely on this component to unpack distribution files. The core technical deficiency lies within the archive parsing logic, where the system fails to adequately sanitize or validate file paths extracted from tar entries before writing them to disk. Unlike the Windows implementation of ast-cli, which includes robust path validation checks that prevent such anomalies, the Unix-based variants lacked these safeguards, creating a significant security gap in cross-platform consistency and safety.
This incomplete validation allows an attacker to craft malicious tar archives containing absolute paths or directory traversal sequences, commonly known as dot-dot-slash attacks. When such an archive is processed by the vulnerable version of ast-cli, the extraction mechanism does not verify that the destination path remains within the intended working directory. Consequently, files can be written to arbitrary locations on the filesystem outside of the designated installation scope. This behavior constitutes a classic Path Traversal vulnerability, categorized under CWE-22 in industry standards for software weakness enumeration. The lack of boundary enforcement enables the manipulation of file system operations beyond their authorized context.
The operational impact of this flaw is severe due to its interaction with trusted distribution channels. Exploitation requires an attacker who has compromised or can manipulate the archive served at download.checkmarx.com, which acts as a source for legitimate software updates and installations. By substituting the official archive with one containing maliciously crafted entries, an adversary could achieve arbitrary code execution by writing executable files to critical system directories or user-specific locations that are automatically executed upon login or service start. This scenario represents a supply chain attack vector where trust in the distribution server is leveraged to bypass local security controls, aligning with MITRE ATT&CK techniques related to software deployment and component replacement.
To mitigate this risk, immediate updates to ast-cli have been deployed which enforce strict path validation during extraction. The updated logic ensures that every entry's resolved destination path is verified against the working directory before any write operation occurs. Absolute paths are explicitly rejected, and relative paths containing traversal sequences are normalized and checked to ensure they do not escape the target directory boundary. Organizations relying on these tools should verify their ast-cli versions are patched to prevent potential exploitation through compromised or maliciously altered distribution archives. Regular auditing of software supply chain integrity remains essential given the high privilege implications associated with installation-time file system access.