ast-cli’s tar extraction logic on Linux and macOS performs incomplete validation of archive entry paths. A malicious tar archive containing absolute or traversal path entries can be used to write files outside the intended install directory. This flaw allows an attacker to place arbitrary files, including executable payloads, on the filesystem. The CVSS score of 6.3 indicates a moderate severity, while the EPSS score is not provided and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is an attacker who compromises the server hosting the download at download.checkmarx.com, replacing the tar archive with a crafted one that exploits the path traversal.

The affected product is Checkmarx ast-cli, which is used for installing the Vorpal ASCA real-time engine and the SCA Resolver. The flaw is only present on Linux and macOS builds; Windows builds use a different extractor that properly validates paths and are not affected.

With a CVSS of 6.3, the risk is moderate. Because the EPSS score is unknown, the precise likelihood of exploitation cannot be quantified, but the vulnerability would allow the placement of arbitrary files on the target system. An attacker who can serve a malicious archive from download.checkmarx.com could write executable files to any location within the filesystem, potentially leading to code execution. The lack of a KEV listing suggests no known active exploits, yet the requirements for exploitation are low: control of the archive source and ability to trigger extraction.