# CVE-2026-77156: ast-cli: Path traversal in tar extraction on Linux/macOS allows writes outside the install directory

Status: published. Published: 2026-10-22. Updated: 2026-11-02.

Incomplete validation of extracted archive entry paths in ast-cli's tar extraction logic on Linux and macOS (used when installing the Vorpal ASCA real-time engine and the SCA Resolver) would allow a malicious tar archive containing absolute or traversal path entries to write files outside the install directory. Windows builds were not affected, as the Windows extractor performs this path validation.



Exploitation required substituting the archive served at "download.checkmarx.com". An attacker able to compromise that server and replace the archive could write arbitrary, executable files to arbitrary filesystem paths via this path traversal.



Extraction now validates that each entry's destination path resolves within the working directory and rejects absolute paths.

## Remediation

No remediation reported in collected sources

## Affected products and versions

- Checkmarx / github.com/checkmarx/ast-cli (github.com/checkmarx/ast-cli): ≥ 0; < 2.3.51 (affected, semver); 2.3.51 (unaffected, semver). Source: CNA: Checkmarx; platforms: MacOS, Linux

## Severity and prioritization

- CVSS 3.1: 6.4 (medium); CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H; source: CNA: Checkmarx

- CVSS 4.0: 6.3 (medium); CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:N/VI:N/VA:N/SC:H/SI:H/SA:H; source: CNA: Checkmarx

- CISA KEV: No listing in collected sources

- EPSS: 0.35% as of 2026-11-01; percentile 28.50%

- SSVC: exploitation none; automatable no; technical impact total; source ADP: CISA-ADP

- Weaknesses: CWE-22

## Exploit evidence

No exploit evidence in collected sources. This is not proof of no exploitation.

## References

- https://github.com/Checkmarx/ast-cli (CNA: Checkmarx; product)

- https://github.com/Checkmarx/ast-cli/security/advisories/GHSA-9gff-3q53-q75x (CNA: Checkmarx; vendor-advisory)

## Provenance

- CNA: Checkmarx: https://www.cve.org/CVERecord?id=CVE-2026-77156; retrieved 2026-11-02; source updated 2026-11-02

- FIRST EPSS: https://api.first.org/data/v1/epss?cve=CVE-2026-77156; retrieved 2026-11-02; source updated Not reported

Revision: 7086164516c061aa8c13a9bd59612326cd55b9bc1b461c7c95d4c3addb7c24ff

Canonical: https://y2.dev/cve/CVE-2026-77156