Threat database

CVE-2026-77157 is a vulnerability in Checkmarx's ast-cli tool where downloaded helper binaries were not verified for integrity before execution. This allowed an attacker who could compromise the download server to substitute malicious binaries that would be executed on developer machines or CI pipelines using affected versions. The issue has been fixed by adding SHA-256 checksum verification of the downloaded archives prior to extraction.

CVE-2026-77156 is a path traversal vulnerability in the tar extraction logic of Checkmarx's ast-cli tool on Linux and macOS. It allows malicious tar archives with absolute or traversal paths to write files outside the intended install directory. Windows versions are not affected due to built-in path validation. Exploitation requires compromising the archive download source. The issue is fixed by validating extraction paths to ensure they remain within the working directory.