Answer in brief
CVE-2026-77156 records a Medium severity (CVSS 6.3) vulnerability in ast-cli: Path traversal in tar extraction on Linux/macOS allows writes outside the install directory. The current sources do not mark it as known exploited. The current feed maps Checkmarx/github.com/checkmarx/ast-cli (generic). Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
CVSS is 6.3. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps Checkmarx/github.com/checkmarx/ast-cli (generic). Check affected ranges and fixed versions before updating.
| Package | Affected range | Fixed version |
|---|---|---|
| Checkmarx/github.com/checkmarx/ast-cligeneric | >=0 <2.3.51 | 2.3.51 |
Published upstream
Oct 22, 2026
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Oct 22, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Oct 22, 2026
Incomplete validation of extracted archive entry paths in ast-cli's tar extraction logic on Linux and macOS (used when installing the Vorpal ASCA real-time engine and the SCA Resolver) would allow a malicious tar archive containing absolute or traversal path entries to write files outside the install directory. Windows builds were not affected, as the Windows extractor performs this path validation. Exploitation required substituting the archive served at "download.checkmarx.com". An attacker able to compromise that server and replace the archive could write arbitrary, executable files to arbitrary filesystem paths via this path traversal. Extraction now validates that each entry's destination path resolves within the working directory and rejects absolute paths.
Quoted source text, attributed separately from HOL analysis.