The hashi-vault-js module concatenates user‑supplied identifiers directly into Vault request paths and query strings without proper encoding, enabling path traversal and query parameter injection. An attacker who can influence these identifiers can direct the module to call arbitrary Vault paths, potentially reading secrets beyond the intended scope or altering query parameters to manipulate the Vault API response. This flaw can lead to confidentiality breaches and may give attackers the ability to execute privileged operations within the Vault system.

Kyndryl Open Source releases of hashi-vault-js prior to version 0.5.2 are affected. The vulnerability exists in the source file Vault.js where lengths of names, usernames, groups, roles, and versions are inserted into request strings without encodeURIComponent or URLSearchParams handling. Updating to v0.5.2 or later resolves the issue.

The CVSS score of 8.7 reflects high severity, but the EPSS score is below 1%, indicating that, as of now, exploitation is unlikely. The flaw is not catalogued in the CISA KEV list. The attack path requires the attacker to supply or manipulate input that is passed to the module, which is common in applications that dynamically construct Vault requests. Consequently, the risk is highest for deployments that expose user input to the module without prior sanitization. Monitoring for any exploitation attempts and applying the patch promptly mitigates the risk.