{
 "version": "https://jsonfeed.org/version/1.1",
 "title": "erlang rebar3: important CVE events",
 "home_page_url": "https://patchwire.jonathanross.dev/products/erlang--rebar3/",
 "feed_url": "https://patchwire.jonathanross.dev/feeds/products/erlang--rebar3/important.json",
 "authors": [
  {
   "name": "Patchwire"
  }
 ],
 "language": "en",
 "items": [
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-103060/disclosed",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-103060/",
   "title": "CVE-2026-103060 · erlang rebar3 · disclosed",
   "content_text": "Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in erlang rebar3 allows a malicious package publisher to delete a directory outside the project's _build directory and extract package files into it when a developer fetches dependencies.\n\nA package release's dependencies in a Hex registry carry an app field that names the dependency's OTP application. rebar3 uses this field as the dependency's name without validating it (rebar_packages:parse_deps/1) and builds the dependency's directory from that name (rebar_app_utils:dep_to_app/7). rebar_fetch:download_source_online/2 deletes that directory with rm -rf and moves the fetched package into it. hex.pm didn't restrict the field to a directory name before 2026-10-12, so a publisher could set it to a value such as ../../../../target. When a project depends on such a release directly or transitively, rebar3 get-deps deletes the directory the name resolves to and writes the dependency's files there. This happens before the dependency's own rebar.config.script is evaluated, and get-deps compiles nothing.\n\nThis issue affects rebar3: from 3.7.0-rc1 before 3.27.2.",
   "date_published": "2026-10-12T15:43:57Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-103060/fixed/debian-14",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-103060/",
   "title": "CVE-2026-103060 · erlang rebar3 · fixed in Debian 14 (rebar3 3.27.3-1)",
   "content_text": "Fixed versions: rebar3 3.27.3-1.",
   "date_published": "2026-10-12T15:43:57Z"
  }
 ]
}