github.com
https://github.com/kyndryl-open-source/hashi-vault-js CVE-2026-55100
HIGH
hashi-vault-js has a path traversal and query parameter injection
Record summary
CVE-2026-55100 has a selected CVSS score of 8.7 (high).
Description
hashi-vault-js is a Node.js module for interacting with the HashiCorp Vault API. Prior to 0.5.2, src/Vault.js concatenates unencoded identifier values including name, username, group, role, and version into Vault request paths and query strings instead of using encodeURIComponent() and URLSearchParams, allowing path traversal and query parameter injection. This issue is fixed in version 0.5.2.
Description source: CVE List
Exploitation context
CISA SSVC decision
ExploitationNone
AutomatableYes
Technical impactPartial
CISA Coordinator · SSVC 2.0.3 · Evaluated Jul 31, 2026 · Source: CVE List
Affected products and versions
2| Product | Source | Version range | Status |
|---|---|---|---|
hashi-vault-jsBrowse kyndryl-open-source / hashi-vault-js | CVE List | < 0.5.2 | affected |
hashi-vault-jsBrowse npm / hashi-vault-js | GitHub Advisory | Before 0.5.2 · Fixed in 0.5.2 | affected |
References
5github.com
https://github.com/kyndryl-open-source/hashi-vault-js/commit/ea2f76052d366a08f35f62ef4c12b6a334c91ec2 github.com
https://github.com/kyndryl-open-source/hashi-vault-js/pull/66 github.com
https://github.com/kyndryl-open-source/hashi-vault-js/releases/tag/v0.5.2 github.comConfirmation
https://github.com/kyndryl-open-source/hashi-vault-js/security/advisories/GHSA-g956-2f74-rmv7