CVE-2026-53777: Perry Path Traversal in WebSocket Artifact Handling

Technical summary

CVE-2026-53777 is a path traversal flaw in Perry's WebSocket message handling. The vulnerability exists in how the application processes the artifact_name and download_path fields within ArtifactReady WebSocket messages. When a client connects to a build server, it accepts path components from the server without proper sanitization. An attacker controlling the server URL can inject directory traversal sequences (such as '../') to escape intended artifact directories and write to arbitrary locations writable by the Perry process, or read files and move them to attacker-accessible paths. The root cause is insufficient input validation on server-supplied path parameters before their use in file operations.

Business impact

A compromised or malicious build server can leverage this vulnerability to corrupt application deployments, inject malicious code into release artifacts, steal source code or configuration secrets from developer machines, or destroy critical build infrastructure. In supply chain scenarios where multiple teams rely on shared build servers, a single compromise can affect numerous downstream systems. The impact extends beyond the developer using Perry—artifacts built through a compromised pipeline may propagate compromised binaries to production environments.

Affected systems

Perry versions before 0.5.1159 are vulnerable. The attack surface includes any deployment where Perry clients connect to build servers, particularly in CI/CD pipelines, distributed build environments, or developer workstations that interact with build infrastructure. The vulnerability does not require authentication to the server, making it a concern for internal networks where build servers might be assumed trustworthy but could be compromised or spoofed.

Exploitability

Exploitation requires control or compromise of the build server URL that the Perry client connects to. An attacker must be in a position to intercept or control the server endpoint—via network compromise, DNS spoofing, or by directly compromising the build infrastructure. While no public exploit code has been weaponized yet (CVE is not yet on CISA's Known Exploited Vulnerabilities list), the attack is straightforward once a malicious server is in place, as it only requires sending crafted WebSocket messages. The requirement for user interaction (the client must actively connect to the server) is a minor limiting factor but does not meaningfully reduce risk in automated or persistent build environments.

Remediation

Upgrade Perry to version 0.5.1159 or later. This version includes input validation and path sanitization for the artifact_name and download_path fields. Additionally, ensure build servers are hardened and monitored for unauthorized changes, restrict network access to build infrastructure, and validate the integrity of downloaded artifacts through checksums or signatures whenever possible.

Patch guidance

Apply the Perry update to 0.5.1159 or later. This should be prioritized for all systems that use Perry in CI/CD pipelines or for automated artifact retrieval. Test the update in a staging environment first to confirm compatibility with your build workflows. Verify that artifact downloads and file paths continue to function as expected after patching. If you have custom build server integrations, review them to ensure they do not introduce similar path traversal issues.

Detection guidance

Monitor Perry client logs for unusual file write patterns, particularly writes outside expected artifact directories. Look for WebSocket messages containing path traversal sequences ('../', '..\', or URL-encoded variants) in the artifact_name or download_path fields. Check system file access logs for unexpected modifications in sensitive directories (e.g., config, home, or application installation directories). Correlate client activity with server behavior to identify when a server may have been compromised. Network monitoring can also flag suspicious WebSocket traffic containing traversal payloads.

Why prioritize this

This vulnerability scores HIGH (CVSS 8.1) due to high integrity and confidentiality impact combined with network accessibility and low complexity of exploitation. While it requires user interaction and does not enable remote code execution directly, the ability to arbitrarily overwrite or exfiltrate files is severe in a build context, where compromise can poison software supply chains. Organizations using Perry in production CI/CD should treat this as a critical priority. Even organizations not yet on vulnerable versions should plan upgrades as part of normal maintenance.

Risk score, explained

CVSS 3.1 score of 8.1 reflects: (1) Network-based attack vector—the malicious server is accessed over the network; (2) Low attack complexity—once the attacker controls the server, exploitation is straightforward; (3) No privilege requirement—unauthenticated server connections are accepted; (4) Required user interaction—the client must initiate a connection; (5) Unchanged scope—impact is limited to the client system; (6) High confidentiality impact—arbitrary files can be read and exfiltrated; (7) High integrity impact—arbitrary files can be overwritten; (8) No availability impact. The score appropriately reflects a high-severity threat in supply chain and build infrastructure contexts.

Frequently asked questions