Comprehensive CVE Analysis of Package Managers Reveals Path Traversal, Injection, and Credential Leakage Vulnerabilities
Patch package managers to enforce path sanitisation, use '--' separator, and verify signatures.
Patch your package manager to enforce path sanitisation, use '--' separator, and verify signatures.
Summary
An exhaustive review of public CVEs across language and system package managers uncovered recurring failure modes that persist for decades. The most prevalent issue is path traversal during archive extraction, with CVE‑2026‑34591 and CVE‑2026‑35206 affecting zip and tar formats. Symlink traversal and backslash handling also contribute to the same class of vulnerabilities. Argument injection in VCS drivers, such as git‑clone, has led to CVEs like CVE‑2021‑29472 and CVE‑2022‑36069. Integrity checks can be bypassed, exemplified by CVE‑2016‑1252 where unsigned content was accepted as signed. Credential leakage occurs when tokens are sent to unintended hosts, as seen in CVE‑2019‑15052 and CVE‑2021‑32690. The analysis highlights that many fixes are partial, leaving residual risks across multiple ecosystems. Developers should enforce strict path sanitisation, use the '--' separator, and verify signatures to mitigate these threats.
Key changes
- Path traversal CVE‑2026‑34591 in zip extraction
- Symlink traversal CVE‑2026‑35206 in tar extraction
- Argument injection CVE‑2021‑29472 in git‑clone
- Integrity check bypass CVE‑2016‑1252 in signed content
- Credential leakage CVE‑2019‑15052 when tokens sent to unintended hosts
- Partial fixes leave residual risks across ecosystems
- Many CVEs involve archive extraction, VCS drivers, and signature verification
- Developers should enforce strict path sanitisation and use '--' separator