CVE-2026-53777: Perry < 0.5.1159 Path Traversal via ArtifactReady WebSocket

Synopsis

A path traversal vulnerability in Perry (the PerryTS build client) before version 0.5.1159 allows a malicious build server to write arbitrary file content to any location the running process can reach. The attack is delivered over the network without any authentication, but requires a user to interact with a malicious server URL; exploitation is possible when an attacker controls the server endpoint the client connects to via WebSocket. Successful exploitation lets an attacker overwrite sensitive local files or move files into attacker-accessible locations, enabling tampered build outputs, credential theft, or privilege escalation depending on the host environment. A patched-image rebuild at version 0.5.1159 is available on HarborGuard for environments running an affected version.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must be reachable over the network as a server that the Perry client connects to via WebSocket.

• AuthenticationNot required

  No credentials are needed; the vulnerability is triggered by any server the client is pointed at, with no account or token required.

• Victim interactionRequired

  A user must direct the Perry client to connect to an attacker-controlled server URL, requiring some degree of social engineering or supply-chain manipulation.

• Attack complexityDetail

  Exploit reliability is high once the attacker controls the server endpoint; no race conditions or special memory layout conditions are required.

Blast Radius

• Attacker writes arbitrary content to any file path writable by the perry process, enabling overwrite of configuration files, SSH keys, shell profiles, or build scripts.
• Attacker moves or copies sensitive local files (credentials, tokens, source code) into a directory the server can subsequently retrieve, exfiltrating them out of the build environment.
• Tampered build artifacts or injected scripts can propagate downstream into CI pipelines, container images, or deployed workloads built on the compromised host.