Vulnerability-Lookup

GHSA-G956-2F74-RMV7

Vulnerability from github – Published: 2026-07-31 17:03 – Updated: 2026-07-31 17:03

Summary

hashi-vault-js has a path traversal and query parameter injection

Details

Summary

The hashi-vault-js library is vulnerable to path traversal and query string injection due to the lack of proper encoding of identifiers in path segments and query strings. This allows attackers to manipulate the request URL and potentially access unintended downstream endpoints or inject malicious parameters if untrusted input is passed to the library.

Details

There are zero calls to encodeURIComponent anywhere in Vault.js. Every identifier (e.g., name, username, group, role, version) provided to the library is concatenated straight into the HTTP URL without URI encoding.

Two vectors can be dynamically confirmed:

Path Traversal: Passing ../../sys/seal as a secret name causes the HTTP client to normalize the path and send the request to /v1/sys/seal instead of the intended Key-Value path.
Query Injection: Passing 1&list=true as a version value injects an extra query parameter into the request payload.

Impact

In applications where Vault identifiers originate from untrusted user input, this allows an unauthenticated attacker to redirect requests to unintended Vault endpoints (including administrative paths under sys/) or otherwise alter the executed query, executing operations within the permissions of the Vault token used by the application.

Patches

This vulnerability has been addressed by wrapping path segments with encodeURIComponent() and safely formatting query strings instead of manual string concatenation. Users should upgrade to a version that includes this fix.

Workarounds

If you cannot immediately update the library, you can mitigate this issue by rigidly validating and sanitizing all user-supplied input before passing it into hashi-vault-js methods. Alternatively, manually encode inputs using encodeURIComponent() before supply them to the library's functions.

Acknowledgements

hashi-vault-js would like to thank Sebastián Alba Vives for reporting this vulnerability.

Severity

8.7 (High)


                  
                    CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 0.5.1"
      },
      "package": {
        "ecosystem": "npm",
        "name": "hashi-vault-js"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "0.5.2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-55100"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-23",
      "CWE-74"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-07-31T17:03:27Z",
    "nvd_published_at": null,
    "severity": "HIGH"
  },
  "details": "## Summary\n\nThe `hashi-vault-js` library is vulnerable to path traversal and query string injection due to the lack of proper encoding of identifiers in path segments and query strings. This allows attackers to manipulate the request URL and potentially access unintended downstream endpoints or inject malicious parameters if untrusted input is passed to the library.\n\n## Details\n\nThere are zero calls to `encodeURIComponent` anywhere in `Vault.js`. Every identifier (e.g., name, username, group, role, version) provided to the library is concatenated straight into the HTTP URL without URI encoding.\n\nTwo vectors can be dynamically confirmed:\n\n1. **Path Traversal:** Passing `../../sys/seal` as a secret name causes the HTTP client to normalize the path and send the request to `/v1/sys/seal` instead of the intended Key-Value path.\n2. **Query Injection:** Passing `1\u0026list=true` as a version value injects an extra query parameter into the request payload.\n\n## Impact\n\nIn applications where Vault identifiers originate from untrusted user input, this allows an unauthenticated attacker to redirect requests to unintended Vault endpoints (including administrative paths under `sys/`) or otherwise alter the executed query, executing operations within the permissions of the Vault token used by the application.\n\n## Patches\n\nThis vulnerability has been addressed by wrapping path segments with `encodeURIComponent()` and safely formatting query strings instead of manual string concatenation. Users should upgrade to a version that includes this fix.\n\n## Workarounds\n\nIf you cannot immediately update the library, you can mitigate this issue by rigidly validating and sanitizing all user-supplied input before passing it into `hashi-vault-js` methods. Alternatively, manually encode inputs using `encodeURIComponent()` before supply them to the library\u0027s functions.\n\n## Acknowledgements\n\nhashi-vault-js would like to thank Sebasti\u00e1n Alba Vives for reporting this vulnerability.",
  "id": "GHSA-g956-2f74-rmv7",
  "modified": "2026-07-31T17:03:27Z",
  "published": "2026-07-31T17:03:27Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/kyndryl-open-source/hashi-vault-js/security/advisories/GHSA-g956-2f74-rmv7"
    },
    {
      "type": "WEB",
      "url": "https://github.com/kyndryl-open-source/hashi-vault-js/pull/66"
    },
    {
      "type": "WEB",
      "url": "https://github.com/kyndryl-open-source/hashi-vault-js/commit/ea2f76052d366a08f35f62ef4c12b6a334c91ec2"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/kyndryl-open-source/hashi-vault-js"
    },
    {
      "type": "WEB",
      "url": "https://github.com/kyndryl-open-source/hashi-vault-js/releases/tag/v0.5.2"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
      "type": "CVSS_V4"
    }
  ],
  "summary": "hashi-vault-js has a path traversal and query parameter injection"
}

CVE-2026-55100 (GCVE-0-2026-55100)

Vulnerability from cvelistv5 – Published: 2026-07-31 17:03 – Updated: 2026-07-31 19:57

Title

hashi-vault-js has a path traversal and query parameter injection

Summary

hashi-vault-js is a Node.js module for interacting with the HashiCorp Vault API. Prior to 0.5.2, src/Vault.js concatenates unencoded identifier values including name, username, group, role, and version into Vault request paths and query strings instead of using encodeURIComponent() and URLSearchParams, allowing path traversal and query parameter injection. This issue is fixed in version 0.5.2.

Severity

8.7 (High)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

SSVC

Exploitation: none Automatable: yes Technical Impact: partial

CISA Coordinator (v2.0.3)

CWE

CWE-23 - Relative Path Traversal
CWE-74 - Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')

Assigner

GitHub_M

References

4 references

URL	Tags
https://github.com/kyndryl-open-source/hashi-vaul…	x_refsource_CONFIRM
https://github.com/kyndryl-open-source/hashi-vaul…	x_refsource_MISC
https://github.com/kyndryl-open-source/hashi-vaul…	x_refsource_MISC
https://github.com/kyndryl-open-source/hashi-vaul…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
kyndryl-open-source	hashi-vault-js	Affected: < 0.5.2

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-55100",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-07-31T19:56:47.845036Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-07-31T19:57:01.760Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "hashi-vault-js",
          "vendor": "kyndryl-open-source",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 0.5.2"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "hashi-vault-js is a Node.js module for interacting with the HashiCorp Vault API. Prior to 0.5.2, src/Vault.js concatenates unencoded identifier values including name, username, group, role, and version into Vault request paths and query strings instead of using encodeURIComponent() and URLSearchParams, allowing path traversal and query parameter injection. This issue is fixed in version 0.5.2."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 8.7,
            "baseSeverity": "HIGH",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "NONE"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-23",
              "description": "CWE-23: Relative Path Traversal",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-74",
              "description": "CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component (\u0027Injection\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-07-31T17:03:41.858Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/kyndryl-open-source/hashi-vault-js/security/advisories/GHSA-g956-2f74-rmv7",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/kyndryl-open-source/hashi-vault-js/security/advisories/GHSA-g956-2f74-rmv7"
        },
        {
          "name": "https://github.com/kyndryl-open-source/hashi-vault-js/pull/66",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/kyndryl-open-source/hashi-vault-js/pull/66"
        },
        {
          "name": "https://github.com/kyndryl-open-source/hashi-vault-js/commit/ea2f76052d366a08f35f62ef4c12b6a334c91ec2",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/kyndryl-open-source/hashi-vault-js/commit/ea2f76052d366a08f35f62ef4c12b6a334c91ec2"
        },
        {
          "name": "https://github.com/kyndryl-open-source/hashi-vault-js/releases/tag/v0.5.2",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/kyndryl-open-source/hashi-vault-js/releases/tag/v0.5.2"
        }
      ],
      "source": {
        "advisory": "GHSA-g956-2f74-rmv7",
        "discovery": "UNKNOWN"
      },
      "title": "hashi-vault-js has a path traversal and query parameter injection"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-55100",
    "datePublished": "2026-07-31T17:03:41.858Z",
    "dateReserved": "2026-06-16T14:41:54.579Z",
    "dateUpdated": "2026-07-31T19:57:01.760Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.

Action not permitted

GHSA-G956-2F74-RMV7

Summary

Details

Impact

Patches

Workarounds

Acknowledgements

CVE-2026-55100 (GCVE-0-2026-55100)

Tags

Sightings

Nomenclature