CVE-2026-55100: hashi-vault-js has a path traversal and query parameter injection
The hashi-vault-js library is vulnerable to path traversal and query string injection due to the lack of proper encoding of identifiers in path segments and query strings. This allows attackers to manipulate the request URL and potentially access unintended downstream endpoints or inject malicious parameters if untrusted input is passed to the library.
References
- github.com/advisories/GHSA-g956-2f74-rmv7
- github.com/kyndryl-open-source/hashi-vault-js/commit/ea2f76052d366a08f35f62ef4c12b6a334c91ec2
- github.com/kyndryl-open-source/hashi-vault-js/pull/66
- github.com/kyndryl-open-source/hashi-vault-js/releases/tag/v0.5.2
- github.com/kyndryl-open-source/hashi-vault-js/security/advisories/GHSA-g956-2f74-rmv7
- nvd.nist.gov/vuln/detail/CVE-2026-55100
Code Behaviors & Features
Detect and mitigate CVE-2026-55100 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →