Listen to this Post
CVE-2026-55100 is a critical vulnerability discovered in the `hashi-vault-js` library, a Node.js module designed to interact with HashiCorp Vault. The core of the issue lies in the library’s failure to properly encode user-controlled identifiers before incorporating them into HTTP requests. An analysis of the source code reveals a complete absence of `encodeURIComponent()` calls within Vault.js. Every identifier, including name, username, group, role, and version, is concatenated directly into URL paths and query strings without any sanitization or encoding.
This flawed implementation creates two primary exploitation vectors. First, a Path Traversal attack is possible by injecting sequences like `../../` into a parameter. For example, supplying `../../sys/seal` as a secret name causes the HTTP client to normalize the path, redirecting the request from the intended Key-Value store path to the administrative `/v1/sys/seal` endpoint. Second, a Query Injection attack can be executed by injecting special characters such as &. For instance, passing `1&list=true` as a version value appends an extra `list=true` parameter to the request, altering the query’s behavior.
The vulnerability is severe because it allows an unauthenticated attacker to manipulate the request URL. If an application passes untrusted user input to the library, an attacker could redirect requests to unintended Vault endpoints, including sensitive administrative paths under /sys/. This could lead to the execution of unauthorized operations with the permissions of the Vault token used by the application. The issue is fixed in version `0.5.2` by implementing proper encoding with `encodeURIComponent()` and using `URLSearchParams` for safe query string formatting.
DailyCVE Form:
Platform: Node.js
Version: < 0.5.2
Vulnerability: Path Traversal/Injection
Severity: Critical (CVSS 8.7)
date: 2026-07-31
Prediction: 2026-08-01
What Undercode Say: Analytics
The vulnerability is rooted in the insecure concatenation of user input into URLs without encoding, as shown in the vulnerable code pattern:
// Vulnerable code example (src/Vault.js prior to 0.5.2)
const path = <code>/v1/secret/data/${secretName}</code>;
// If secretName = "../../sys/seal", the path becomes "/v1/sys/seal"
The fix involves wrapping all path segments with `encodeURIComponent()` and utilizing `URLSearchParams` for query construction:
// Patched code example (src/Vault.js version 0.5.2)
const safePath = <code>/v1/secret/data/${encodeURIComponent(secretName)}</code>;
const params = new URLSearchParams({ version: versionInput });
// versionInput = "1&list=true" is safely encoded as "1%26list%3Dtrue"
This CVE is associated with CWE-23: Relative Path Traversal and CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component (‘Injection’).
Exploit
An attacker can exploit this vulnerability by crafting malicious input to manipulate the request URL.
– Path Traversal Exploit: By setting the `secretName` parameter to ../../sys/seal, the request is redirected to the Vault seal endpoint.
Example request demonstrating path traversal GET /v1/secret/data/../../sys/seal HTTP/1.1 Host: vault.example.com X-Vault-Token: hvs.xxxxxx
– Query Injection Exploit: By setting the `version` parameter to 1&list=true, an extra query parameter is injected.
Example request demonstrating query injection GET /v1/secret/data/my-secret?version=1&list=true HTTP/1.1 Host: vault.example.com X-Vault-Token: hvs.xxxxxx
Protection
Protecting against CVE-2026-55100 requires immediate action:
- Upgrade: The primary and most effective solution is to upgrade the `hashi-vault-js` library to version 0.5.2 or later.
npm install [email protected]
- Workaround: If an immediate upgrade is not possible, implement strict input validation and sanitization for all user-supplied data before passing it to the library. As a temporary measure, manually encode inputs using
encodeURIComponent().// Workaround: Manually encode user input const safeSecretName = encodeURIComponent(userProvidedSecretName); vault.read(safeSecretName);
Impact
Successful exploitation of this vulnerability can have severe consequences:
– Unauthorized Access: An attacker can redirect requests to unintended Vault endpoints, including sensitive administrative paths under `/sys/` (e.g., /sys/seal, /sys/health).
– Privilege Escalation: By manipulating the request, an attacker could execute operations with the permissions of the Vault token used by the application.
– Data Breach: If an attacker can redirect a request to a path that exposes secrets or configuration data, it could lead to a significant data breach.
– Integrity Impact: While the primary impact is on confidentiality, an attacker could potentially alter the state of the Vault instance if they can access administrative endpoints.
🎯Let’s Practice Exploiting & Learn Patching For Free:
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
