CVE WATCH / VULNERABILITY DETAIL
CVE-2026-77156
MEDIUMCVSS 6.4NVD feed
Published 22 October 2026 · tracked since 23 October 2026
Description
Incomplete validation of extracted archive entry paths in ast-cli's tar extraction logic on Linux and macOS (used when installing the Vorpal ASCA real-time engine and the SCA Resolver) would allow a malicious tar archive containing absolute or traversal path entries to write files outside the instal
References
- NVD — National Vulnerability Database
- CVE.org record (MITRE)
- CISA Known Exploited Vulnerabilities catalog