CVE-2026-55100 Details
Description
hashi-vault-js is a Node.js module for interacting with the HashiCorp Vault API. Prior to 0.5.2, src/Vault.js concatenates unencoded identifier values including name, username, group, role, and version into Vault request paths and query strings instead of using encodeURIComponent() and URLSearchParams, allowing path traversal and query parameter injection. This issue is fixed in version 0.5.2.
A path traversal and query parameter injection vulnerability exists in the hashi-vault-js library, specifically in versions through 0.5.1. The issue arises from the library's failure to properly encode identifiers before incorporating them into HTTP request paths and query strings. This oversight allows for manipulation of the request URL, potentially leading to unauthorized access of downstream endpoints or injection of malicious query parameters, particularly if the input is derived from untrusted sources.
Users are advised to upgrade to version 0.5.2, which addresses the vulnerability by properly encoding path segments and query strings. If an immediate upgrade is not possible, validate and sanitize user input before it is passed to the library, or manually encode the input using `encodeURIComponent()`.
Metrics
CVSS 4.0 Severity and Vector Strings:
CVSS 3.x Severity and Vector Strings:
No CVSS 3.x data is available for this CVE.
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Jul 31, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-23 | Relative Path Traversal | [email protected] |
| CWE-74 | Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') | [email protected] |
Affected Products
No affected product data is available for this CVE.
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 31, 2026 | CVE Modified | CISA-ADP |
| Jul 31, 2026 | New CVE Received | [email protected] |