CVE-2026-77156

MediumCVSS 6.4

Published: 22/10/2026(UTC)Updated: 02/11/2026(UTC)Translated: 22/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.35%

28th percentile - higher than 28% of all known CVEs

Summary

Incomplete validation of extracted archive entry paths in ast-cli's tar extraction logic on Linux and macOS (used when installing Vorpal ASCA and SCA Resolver) allows a malicious tar archive with absolute or traversal path entries to write files outside the install directory. Windows builds were not affected, as the Windows extractor performs this path validation.

Risk Assessment

Exploitation requires substituting the archive served at download.checkmarx.com; an attacker compromising that server could write arbitrary executable files to arbitrary filesystem paths.

Recommendation

Update ast-cli to a patched version that validates each entry's destination path resolves within the working directory and rejects absolute paths.

Other vulnerabilities in ast-cli

CVE-2026-77157Medium
ast-cli downloads two helper binaries, the Vorpal ASCA engine and the SCA Resolver, from download.checkmarx.com as part of its auto-update flow, triggered by Checkmarx VSCode/JetBrains extensions and cx scan sca-realtime. Prior to the fix, the downloaded archive was not verified against a checksum before extraction and execution. An attacker able to substitute the served archive could deliver an arbitrary binary that ast-cli would extract and execute.

Original NVD description (English source)

Incomplete validation of extracted archive entry paths in ast-cli's tar extraction logic on Linux and macOS (used when installing the Vorpal ASCA real-time engine and the SCA Resolver) would allow a malicious tar archive containing absolute or traversal path entries to write files outside the install directory. Windows builds were not affected, as the Windows extractor performs this path validation. Exploitation required substituting the archive served at "download.checkmarx.com". An attacker able to compromise that server and replace the archive could write arbitrary, executable files to arbitrary filesystem paths via this path traversal. Extraction now validates that each entry's destination path resolves within the working directory and rejects absolute paths.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS