CVE-2026-55100CWE-23CWE-74

CVE-2026-55100

published July 31, 2026

CVSS
8.7
EPSS
1%
Percentile
45.8
In the wild
Unconfirmed
What it is

hashi-vault-js is a Node.js module for interacting with the HashiCorp Vault API. Prior to 0.5.2, src/Vault.js concatenates unencoded identifier values including name, username, group, role, and version into Vault request paths and query strings instead of using encodeURIComponent() and URLSearchParams, allowing path traversal and query parameter injection. This issue is fixed in version 0.5.2.

The record
Technical detail
CVSS
8.7 · NONE
CVSS v4.0
Not supplied
EPSS
0.00560 · 45.8th percentile
Weaknesses
CWE-23 · Relative Path Traversal; CWE-74 · Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')
Published
2026-07-31T22:17Z
References (4)
https://github.com/kyndryl-open-source/hashi-vault-js/commit/ea2f76052d366a08f35f62ef4c12b6a334c91ec2 · [email protected]https://github.com/kyndryl-open-source/hashi-vault-js/pull/66 · [email protected]https://github.com/kyndryl-open-source/hashi-vault-js/releases/tag/v0.5.2 · [email protected]https://github.com/kyndryl-open-source/hashi-vault-js/security/advisories/GHSA-g956-2f74-rmv7 · [email protected]
EPSS history
Timeline
  • 31 JUL 17:03Z
    hashi-vault-js has a path traversal and query parameter injection
    cvelistv5