CVE-2026-77156

Incomplete validation of extracted archive entry paths in ast-cli's tar extraction logic on Linux and macOS (used when installing the Vorpal ASCA real-time engine and the SCA Resolver) would allow a malicious tar archive containing absolute or traversal path entries to write files outside the install directory. Windows builds were not affected, as the Windows extractor performs this path validation. Exploitation required substituting the archive served at "download.checkmarx.com". An attacker able to compromise that server and replace the archive could write arbitrary, executable files to arbitrary filesystem paths via this path traversal. Extraction now validates that each entry's destination path resolves within the working directory and rejects absolute paths.

• CWE-22

• https://github.com/Checkmarx/ast-cli
• https://github.com/Checkmarx/ast-cli/security/advisories/GHSA-9gff-3q53-q75x

Published

Oct 22, 2026

Last Modified

Oct 22, 2026

Status

Received

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-77146The extension's invitation controller fails to stop processi…8.3
• CVE-2026-77147Improper Control of Generation of Code ('Code Injection') vu…6.5
• CVE-2026-77148A vulnerability was found in Comfast CF-N1-S 2.6.0.1. This i…9.9
• CVE-2026-7715A vulnerability has been found in ravenwits mcp-server-arang…6.3
• CVE-2026-77150The Unlimited Elements For Elementor plugin for WordPress is…6.1
• CVE-2026-77151A security flaw has been discovered in lin-snow Ech0 up to 5…3.7
• CVE-2026-77157ast-cli downloads two helper binaries, the Vorpal ASCA real-…6.4
• CVE-2026-77159A symlink-following flaw was found in libvirt's qemuTPMEmula…5.5
• CVE-2026-7716A vulnerability was found in code-projects Gym Management Sy…6.3
• CVE-2026-77161The Smart Marketing SMS and Newsletters Forms plugin for Wor…6.5
• CVE-2026-77164Circles' remote-instance signature verification fetches the …6.2
• CVE-2026-77165File owners were unable to unlock TYPE_TOKEN locks placed by…6.5