CVE-2026-77156: CWE-22 in Checkmarx github.com/checkmarx/ast-cli

The vulnerability in Checkmarx's ast-cli (github.com/checkmarx/ast-cli) arises from incomplete validation of extracted archive entry paths during tar extraction on Linux and macOS platforms. This flaw allows a maliciously crafted tar archive containing absolute or directory traversal paths to write files outside the designated installation directory. The Windows extractor is not vulnerable as it performs proper path validation. Exploitation requires an attacker to substitute the archive served at download.checkmarx.com, enabling arbitrary and potentially executable file writes to arbitrary filesystem locations. The fix involves validating that each extracted entry's destination path resolves within the working directory and rejecting absolute paths.

Successful exploitation could allow an attacker who can replace the archive at the download source to write arbitrary files, including executable ones, to arbitrary filesystem paths outside the intended installation directory. This can lead to code execution, system compromise, and integrity violations. The vulnerability affects Linux and macOS installations of ast-cli but not Windows builds.

A fix is available that validates extracted archive entry paths to ensure they reside within the working directory and rejects absolute paths. Users should upgrade to version 2.3.51 or later of ast-cli where this issue is resolved. Since this is not a cloud service, remediation requires applying the updated software version. There are no known exploits in the wild at this time.