CVE-2026-55100 hashi-vault-js has a path traversal and query parameter injection
Attackers can manipulate Vault API requests via path traversal and query injection due to missing input encoding in the hashi-vault-js library.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-55100?
CVE-2026-55100 is a high-severity path traversal vulnerability in kyndryl-open-source hashi-vault-js, published on 31 Jul 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
hashi-vault-js is a Node.js module for interacting with the HashiCorp Vault API. Prior to 0.5.2, src/Vault.js concatenates unencoded identifier values including name, username, group, role, and version into Vault request paths and query strings instead of using encodeURIComponent() and URLSearchParams, allowing path traversal and query parameter injection. This issue is fixed in version 0.5.2.
Which versions are affected by CVE-2026-55100?
2 open source packages ship an affected version, including hashi-vault-js.
| Package | Affected | Fixed in |
|---|---|---|
hashi-vault-js npm | All versions | 0.5.2 |
hashi-vault-js npm | All versions | 0.5.2 |
How do I fix CVE-2026-55100?
Upgrade hashi-vault-js to 0.5.2 or later.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2026-55100 being exploited?
There is no known exploitation of CVE-2026-55100 in the wild and no public exploit code.
Sources
Also known as GHSA-g956-2f74-rmv7.