{"id":"CVE-2026-77156","kind":"vulnerability","aliases":["CVE-2026-77156"],"related":[],"title":"ast-cli: tar extraction lets archive entries write outside install directory","description":"Incomplete validation of extracted archive entry paths in ast-cli's tar extraction logic on Linux and macOS (used when installing the Vorpal ASCA real-time engine and the SCA Resolver) would allow a malicious tar archive containing absolute or traversal path entries to write files outside the install directory. Windows builds were not affected, as the Windows extractor performs this path validation.\n\n\n\nExploitation required substituting the archive served at \"download.checkmarx.com\". An attacker able to compromise that server and replace the archive could write arbitrary, executable files to arbitrary filesystem paths via this path traversal.\n\n\n\nExtraction now validates that each entry's destination path resolves within the working directory and rejects absolute paths.","summary":"ast-cli's tar extraction on Linux and macOS does not fully validate entry paths, so a crafted archive with absolute or traversal paths can write files outside the install directory. Exploitation requires an attacker to replace the archive served from download.checkmarx.com, after which arbitrary executable files can be written to arbitrary paths.","severity":"medium","cvss":6.4,"epss":0.00349,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["ast-cli","checkmarx","ci-cd","linux","macos","package"],"not_affected_if":["no-ast-cli-install","windows"],"how_to_check":"- Check the installed ast-cli version with `ast-cli --version` (exact affected version range unknown)\n- Look for ast-cli or Vorpal ASCA / SCA Resolver installs on Linux or macOS hosts and review the install directory\n- Confirm whether the install step pulls archives from download.checkmarx.com","fix":"- Upgrade ast-cli to a release that includes the fix (fixed version unknown from sources)\n- Reinstall the Vorpal ASCA real-time engine and SCA Resolver after upgrading\n- Verify the install directory and check for unexpected files written outside it","status":"open","published_at":"2026-10-22T18:17:29+00:00","first_seen_at":"2026-10-23T21:57:31+00:00","triaged_at":"2026-10-25T03:59:17+00:00","updated_at":"2026-10-25T03:59:17+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-10-25T03:59:17Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade ast-cli to a release that includes the fix (fixed version unknown from sources)\n- Reinstall the Vorpal ASCA real-time engine and SCA Resolver after upgrading\n- Verify the install directory and check for unexpected files written outside it","reach":"unknown","title":"ast-cli: tar extraction lets archive entries write outside install directory","impact":"high","summary":"ast-cli's tar extraction on Linux and macOS does not fully validate entry paths, so a crafted archive with absolute or traversal paths can write files outside the install directory. Exploitation requires an attacker to replace the archive served from download.checkmarx.com, after which arbitrary executable files can be written to arbitrary paths.","category":"package","nicknames":[],"who_cares":["ast-cli","checkmarx","linux","macos","ci-cd"],"confidence":0.7,"needs_auth":"unknown","worst_case":"Attacker writes arbitrary executable files to arbitrary filesystem paths.","analyst_note":"Confirm the fixed ast-cli version and affected version range from the NVD entry or Checkmarx advisory; the sources do not name them.","how_to_check":"- Check the installed ast-cli version with `ast-cli --version` (exact affected version range unknown)\n- Look for ast-cli or Vorpal ASCA / SCA Resolver installs on Linux or macOS hosts and review the install directory\n- Confirm whether the install step pulls archives from download.checkmarx.com","needs_analyst":true,"not_affected_if":["windows","no-ast-cli-install"],"who_is_affected":"Teams that install or run Checkmarx ast-cli on Linux or macOS, including when it installs the Vorpal ASCA real-time engine or SCA Resolver. Windows builds were not affected. Exposure depends on an attacker being able to substitute the archive served from download.checkmarx.com, so the risk is mainly about the integrity of that download source.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"medium"},"cost_usd":0.000706,"input_tokens":3496,"output_tokens":713,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-2026':14A,17A '-77156':15A,18A 'abl':158C 'absolut':50B,123C,196C 'affect':139C 'allow':117C 'arbitrari':74B,81B,169C,173C 'archiv':7A,48B,68B,87C,121C,152C,166C 'asca':107C 'ast':2A,20B,30B,92C 'ast-c':1A,19B,29B,91C 'attack':64B,157C 'build':136C 'cd':25B 'checkmarx':22B 'ci':24B 'ci-cd':23B 'cli':3A,21B,31B,93C 'compromis':160C 'contain':122C 'could':167C 'craft':47B 'cve':13A,16A 'destin':187C 'directori':12A,60B,134C,193C 'download.checkmarx.com':71B,155C 'engin':111C 'entri':8A,43B,88C,127C,185C 'execut':75B,170C 'exploit':61B,148C 'extract':5A,34B,86C,96C,180C 'extractor':143C 'file':56B,76B,130C,171C 'filesystem':174C 'fulli':41B 'incomplet':83C 'instal':11A,59B,104C,133C 'let':6A 'linux':26B,36B,99C 'logic':97C 'maco':27B,38B,101C 'malici':119C 'outsid':10A,57B,131C 'packag':28B 'path':44B,53B,82B,89C,126C,146C,175C,178C,188C,197C 'perform':144C 'real':109C 'real-tim':108C 'reject':195C 'replac':66B,164C 'requir':62B,149C 'resolv':115C,189C 'sca':114C 'serv':69B,153C 'server':162C 'substitut':150C 'tar':4A,33B,95C,120C 'time':110C 'travers':52B,125C,179C 'use':102C 'valid':42B,84C,147C,182C 'via':176C 'vorpal':106C 'window':135C,142C 'within':190C 'work':192C 'would':116C 'write':9A,55B,129C,168C 'written':79B","nicknames":[],"mitigations":[],"who_affected":"Teams that install or run Checkmarx ast-cli on Linux or macOS, including when it installs the Vorpal ASCA real-time engine or SCA Resolver. Windows builds were not affected. Exposure depends on an attacker being able to substitute the archive served from download.checkmarx.com, so the risk is mainly about the integrity of that download source.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-22T18:17:29+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:N/VI:N/VA:N/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"596c5446-0ce5-4ba2-aa66-48b3b757a647","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-77156","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-77156","severity":null,"published_at":"2026-10-22T18:17:29+00:00","modified_at":"2026-10-23T19:57:42+00:00","first_seen_at":"2026-10-23T21:57:31+00:00","fetched_at":"2026-10-23T22:29:02+00:00","note":null},{"source":"epss","external_id":"CVE-2026-77156","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-77156","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-24T07:15:51+00:00","fetched_at":"2026-10-24T07:15:51+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}