highCVE-2026-55100Jul 31, 2026

CVE-2026-55100: hashi-vault-js Path Traversal and Query Parameter Injection

Pranav Khune
Penetration Testing Team Lead, SecureLayer7

The hashi-vault-js npm library passes user-supplied identifiers directly into Vault API URLs without encoding, letting an attacker redirect requests to arbitrary Vault endpoints or inject extra query…

Packagehashi-vault-js
Ecosystemnpm
Affected<= 0.5.1
Fixed in0.5.2
CVE-2026-55100: hashi-vault-js Path Traversal and Query Parameter Injection

The problem

Every identifier accepted by hashi-vault-js (secret names, usernames, roles, version numbers, etc.) is concatenated raw into the HTTP request URL inside Vault.js. There is no call to encodeURIComponent anywhere in the file.

An attacker who can influence any of those identifiers can do two things: supply a path like ../../sys/seal to escape the intended KV mount and hit any Vault API path, or inject extra query parameters by embedding an ampersand in a version value. Because the request runs under the application's Vault token, the attacker inherits all of its permissions, including administrative ones.

Proof of concept

A working proof-of-concept for CVE-2026-55100 in hashi-vault-js, with the exact payload below.

javascript
// Vector 1: Path traversal - redirects to /v1/sys/seal instead of the KV path
await vault.readKVSecret(token, '../../sys/seal');
// Resulting URL: GET /v1/secret/data/../../sys/seal  ->  normalized to  /v1/sys/seal

// Vector 2: Query parameter injection - injects list=true into the request
await vault.readKVSecret(token, 'my-secret', '1&list=true');
// Resulting URL: GET /v1/secret/data/my-secret?version=1&list=true

The root cause (CWE-23 / CWE-74) is simple concatenation: the library builds URLs like ${this.baseUrl}/${mount}/data/${name}?version=${version} with no encoding at any step. The HTTP client then normalizes the dot-dot segments, silently routing the request to a completely different endpoint.

The version parameter is equally unguarded, so an ampersand in that value splits the query string and injects an arbitrary parameter.

Patch commit ea2f760 fixed both vectors by wrapping every path segment with encodeURIComponent() and replacing manual query-string concatenation with a URLSearchParams object, so neither slashes nor ampersands can survive into the final URL.

The fix

Upgrade hashi-vault-js to version 0.5.2 or later. If an immediate upgrade is not possible, validate all user-supplied identifiers against a strict allowlist (alphanumeric plus hyphens and underscores only) before passing them to any library method, or encode them yourself with encodeURIComponent() before the call.

Reported by Sebastián Alba Vives.

References: [1][2][3][4][5]

Related research