Gleam fails to validate the OTP application name field in Hex package metadata, allowing an attacker to set a value that resolves to a directory outside the intended build space. When a dependency fails to compile, Gleam deletes the directory that name points to, potentially removing critical files or directories, thereby compromising confidentiality and availability during a normal build process.

All installations of the Gleam language compiler from version 0.32.4 up to (but not including) 1.19.2 are affected when they build projects that depend on Hex packages whose 'app' field contains an unvalidated path. This includes developers and CI environments that automatically fetch and compile dependencies on any operating system.

The CVSS score of 5.9 indicates moderate severity. EPSS data is unavailable, so the likelihood of active exploitation is indeterminate, though the CNA advisory points to a potential risk. The flaw is a path‑traversal issue (CWE‑22) and is not listed in CISA’s KEV catalog. The likely attack vector, inferred from the description, involves a malicious or compromised package publisher inserting a crafted application name into the HEX package metadata; the vulnerability is triggered when a developer or CI server rebuilds a project that uses such a faulty dependency, potentially causing deletion of user‑controlled files outside the project workspace.