CVE-2026-55100: 
JavaScript vulnerability analysis and mitigation

CVE-2026-55100 is a path traversal and query parameter injection vulnerability in hashi-vault-js, a Node.js module for interacting with the HashiCorp Vault API, maintained by Kyndryl Open Source. The vulnerability affects all versions up to and including 0.5.1, and was reported by researcher Sebastián Alba Vives, with the advisory published on June 9, 2026 and patched in version 0.5.2. It carries a CVSS v4.0 base score of 8.7 (High) (Github Advisory).

The root cause is the complete absence of URI encoding in src/Vault.js: every identifier value (name, username, group, role, version) is concatenated directly into HTTP request paths and query strings without calling encodeURIComponent() or using URLSearchParams, classified as CWE-23 (Relative Path Traversal) and CWE-74 (Injection) (Github Advisory). Two concrete attack vectors are confirmed: (1) Path Traversal — passing ../../sys/seal as a secret name causes the HTTP client to normalize the path and route the request to /v1/sys/seal instead of the intended Key-Value path; (2) Query Injection — passing 1&list=true as a version value injects an extra query parameter into the request. Exploitation requires no authentication and no user interaction, and is possible from the network without special preconditions, making it highly automatable (Github Advisory, GitHub PR #66).

Successful exploitation allows an attacker to redirect Vault API requests to unintended endpoints — including sensitive administrative paths under sys/ (e.g., triggering a seal operation) — or inject arbitrary query parameters, all executing within the permissions of the Vault token used by the application. The primary impact is high confidentiality loss, as secrets and sensitive Vault data may be exposed or administrative operations invoked without authorization. Integrity and availability of the vulnerable system are not directly impacted per the CVSS scoring, but the ability to reach administrative Vault endpoints could enable destructive operations depending on the token's privilege level (Github Advisory).

1. Identify target applications: Locate Node.js applications that use hashi-vault-js versions ≤ 0.5.1 and accept user-controlled input that is passed to library methods (e.g., secret names, usernames, roles, or version parameters).
2. Craft a path traversal payload: Supply a malicious identifier such as ../../sys/seal as a secret name parameter. The library concatenates this directly into the Vault API URL (e.g., /v1/secret/data/../../sys/seal), which the HTTP client normalizes to /v1/sys/seal.
3. Trigger the request: Submit the crafted input through the application's interface (e.g., an API endpoint or form field that invokes a hashi-vault-js method). The library sends the manipulated HTTP request to the Vault server using the application's Vault token.
4. Exploit query parameter injection: Alternatively, pass a version value such as 1&list=true to inject additional query parameters into the Vault API request, potentially altering the operation performed.
5. Achieve unauthorized Vault operations: Depending on the Vault token's permissions, the attacker can access unintended secrets, enumerate paths, or invoke administrative operations (e.g., sealing the Vault) within the scope of the application's token (Github Advisory).

• Network: Vault API requests containing URL-encoded or raw ../ sequences in path segments (e.g., requests to /v1/sys/ endpoints originating from application-tier services rather than administrative clients); unexpected requests to administrative Vault paths such as /v1/sys/seal, /v1/sys/mounts, or /v1/sys/auth from application service accounts.
• Logs: Vault audit logs showing requests to sys/ administrative endpoints authenticated with application-tier tokens (rather than admin tokens); query strings containing unexpected parameters (e.g., list=true appended to non-list operations); HTTP 400/403/404 errors in Vault logs for malformed or unauthorized path traversal attempts.
• Application Logs: Node.js application logs showing unusual or unexpected Vault API error responses (e.g., path not found, permission denied on sys/ paths) when processing user-supplied identifiers.

Users should upgrade hashi-vault-js to version 0.5.2, which wraps all path segments with encodeURIComponent() and replaces manual query string concatenation with safe URLSearchParams formatting (GitHub Release v0.5.2, Github Advisory). As an interim workaround for those unable to upgrade immediately, strictly validate and sanitize all user-supplied input before passing it to hashi-vault-js methods, or manually encode inputs using encodeURIComponent() prior to supplying them to library functions. Additionally, applying the principle of least privilege to Vault tokens used by the application will limit the blast radius of any successful exploitation.