{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","feed_url":"https://feed.craftedsignal.io/products/hashi-vault-js-0.5.1/feed.json","home_page_url":"https://feed.craftedsignal.io/","items":[{"_cs_actors":[],"_cs_cpes":[],"_cs_cves":[{"id":"CVE-2026-55100"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["hashi-vault-js (0.5.1)"],"_cs_severities":["high"],"_cs_tags":["web-application","injection","path-traversal","npm","cve-2026-55100"],"_cs_type":"advisory","_cs_vendors":[],"content_html":"\u003cp\u003eThe npm package \u003ccode\u003ehashi-vault-js\u003c/code\u003e (versions 0.5.1 and earlier) contains critical flaws in how it constructs HTTP requests for the HashiCorp Vault API. The library fails to perform URI encoding on identifier parameters, such as secret names, versions, or group names, before concatenating them into request strings.\u003c/p\u003e\n\u003cp\u003eThis implementation error allows two distinct exploitation vectors: Path Traversal and Query Parameter Injection. An attacker capable of influencing the input provided to these methods can force the client to target arbitrary Vault API endpoints, including sensitive administrative paths prefixed with \u003ccode\u003e/sys/\u003c/code\u003e. If the application uses a token with high-privileged permissions, an attacker may be able to perform unauthorized administrative actions, such as unsealing the vault or modifying system configurations, depending on the scope of the token assigned to the vulnerable application.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eThe application consumes user-supplied input (e.g., from a URL parameter, form field, or API request).\u003c/li\u003e\n\u003cli\u003eThe application passes this untrusted input into a \u003ccode\u003ehashi-vault-js\u003c/code\u003e method (e.g., secret retrieval or versioning).\u003c/li\u003e\n\u003cli\u003eThe \u003ccode\u003ehashi-vault-js\u003c/code\u003e library concatenates the raw input directly into the destination URL string without sanitization.\u003c/li\u003e\n\u003cli\u003eThe attacker provides a payload such as \u003ccode\u003e../../sys/seal\u003c/code\u003e to trigger a path traversal or \u003ccode\u003e1\u0026amp;list=true\u003c/code\u003e for query injection.\u003c/li\u003e\n\u003cli\u003eThe library's HTTP client normalizes the resulting malicious URL path or query string.\u003c/li\u003e\n\u003cli\u003eThe client transmits the request to an unintended administrative Vault API endpoint.\u003c/li\u003e\n\u003cli\u003eThe Vault server processes the request within the context of the application's authenticated session token.\u003c/li\u003e\n\u003cli\u003eThe attacker achieves unauthorized read/write or configuration operations depending on the token's configured policy.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows unauthorized interaction with the Vault server. By redirecting requests to administrative endpoints, an attacker can bypass intended logic, potentially leading to unauthorized data exposure, configuration modification, or service disruption. The impact is primarily constrained by the policy permissions associated with the service account token used by the vulnerable application.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eUpdate \u003ccode\u003ehashi-vault-js\u003c/code\u003e to a patched version that implements \u003ccode\u003eencodeURIComponent\u003c/code\u003e for all path segments and query parameters.\u003c/li\u003e\n\u003cli\u003eAudit all application code that utilizes \u003ccode\u003ehashi-vault-js\u003c/code\u003e to ensure that any variable input passed to the library is validated against a strict allowlist.\u003c/li\u003e\n\u003cli\u003eAs an immediate temporary workaround, manually sanitize and encode all user-supplied variables using \u003ccode\u003eencodeURIComponent()\u003c/code\u003e before passing them to the library's methods.\u003c/li\u003e\n\u003cli\u003eEnsure that the Vault tokens assigned to applications follow the principle of least privilege, minimizing the damage potential if the application is compromised via these injection vectors.\u003c/li\u003e\n\u003c/ol\u003e\n","date_modified":"2026-07-31T19:29:29Z","date_published":"2026-07-31T19:29:29Z","id":"https://feed.craftedsignal.io/briefs/2026-07-hashi-vault-js-traversal/","summary":"The hashi-vault-js library is vulnerable to path traversal and query injection due to insufficient URI encoding, potentially allowing attackers to redirect administrative Vault requests if untrusted input is passed to the library.","title":"Path Traversal and Query Injection in hashi-vault-js","url":"https://feed.craftedsignal.io/briefs/2026-07-hashi-vault-js-traversal/"}],"language":"en","title":"CraftedSignal Threat Feed - Hashi-Vault-Js (0.5.1)","version":"https://jsonfeed.org/version/1.1"}