CVE-2026-55100 HIGH

CVE-2026-55100: hashi-vault-js has a path traversal and query parameter injection

Vendor Kyndryl-Open-Source

Product hashi-vault-js

Weakness CWE-23

Published July 31, 2026

Last update July 31, 2026

View on NVD All CVEs

CVSS base score

8.7/10

Attack vector Network

Attack complexity Low

Privileges required None

User interaction None

Confidentiality —

Integrity —

CVSS vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

What the vulnerability does

01Description

hashi-vault-js is a Node.js module for interacting with the HashiCorp Vault API. Prior to 0.5.2, src/Vault.js concatenates unencoded identifier values including name, username, group, role, and version into Vault request paths and query strings instead of using encodeURIComponent() and URLSearchParams, allowing path traversal and query parameter injection. This issue is fixed in version 0.5.2.

Key dates

02Disclosure timeline

July 31, 2026 CVE published

External resources

03References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2026-55100 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/23.html AskarLabs — CWE-23 write-up Relative Path Traversal

Related vulnerabilities

04Related CVE

CVE-2025-0822 Bit Assist <= 1.5.2 - Path Traversal to Authenticated (Subscriber+) Arbitrary File Read via fileID Parameter CVE-2026-8073 Kirki <= 6.0.6 - Unauthenticated Limited Arbitrary File Read and Deletion via downloadZIP CVE-2024-13791 Bit Assist <= 1.5.2 - Path Traversal to Authenticated (Administrator+) Arbitrary File Read via downloadResponseFile Function CVE-2024-50453 WordPress The Pack Elementor addons plugin <= 2.0.9 - Local File Inclusion vulnerability CVE-2025-2056 WP Ghost <= 5.4.01 - Unauthenticated Limited File Read