Path Traversal in Perry Build Artifact Handling

Perry before 0.5.1159 contains a path traversal vulnerability that allows a malicious build server to write arbitrary content to any location writable by the running process by supplying unsanitized path components in the artifact_name field of ArtifactReady WebSocket messages. Attackers controlling the server URL can deliver traversal payloads through the artifact_name or download_path fields, causing the client to overwrite sensitive files or expose arbitrary local files to an attacker-accessible location.

Casky was already ahead

This CVE exploits attack patterns that Casky's 331matched skills already investigate — long before this vulnerability was disclosed. Claude's reasoning model maps these techniques to MITRE ATT&CK, so practitioners who ran these skills have already seen the threat behaviour in their findings.

Analysis

Perry before version 0.5.1159 contains a critical path traversal vulnerability in its WebSocket message handling that allows attackers to write arbitrary files to any location accessible by the running process. The vulnerability exists in the artifact_name and download_path fields of ArtifactReady messages, where unsanitized path components enable an attacker controlling a malicious build server to bypass directory restrictions. This affects any organization using Perry as a build client that connects to untrusted or compromised build servers, potentially leading to arbitrary code execution, credential theft, or system compromise by overwriting critical files like configuration files, executables, or SSH keys.

Casky's 331 mapped skills leverage Claude's extended reasoning to detect the attack patterns underlying this vulnerability across MITRE ATT&CK techniques TA0001 (Initial Access) and TA0007 (Discovery). Practitioners using Casky would identify suspicious patterns including: malformed artifact paths containing traversal sequences (../, ..\ patterns), WebSocket messages originating from unexpected server sources, unusual file write operations to sensitive system directories, and process behavior attempting to write outside designated artifact cache directories. The platform's skill set would flag reconnaissance activities (Discovery) where attackers probe file system permissions, combined with execution attempts (Initial Access) that deliver payloads through seemingly legitimate build artifacts, helping security teams correlate these attack chains before exploitation occurs.

Live Threat IntelligenceComing soon

Casky Risk Score

—

EPSS Probability

—

Shodan Exposure

—

GreyNoise Signal

—

Composite risk scoring from EPSS, CISA KEV, Shodan, and GreyNoise — 21 security APIs correlated into a single Casky Risk Score. Coming in Casky Pro. Join early access →

331 Casky skills cover this attack pattern

These skills use Claude AI's reasoning model to surface findings in the same attack categories as CVE-2026-53777.

analyzing-cloud-storage-access-patterns

cloud security · low

Run

analyzing-ios-app-security-with-objection

mobile security · low

Run

analyzing-malicious-url-with-urlscan

phishing defense · medium

Run

MITRE ATT&CK Techniques

TA0001 TA0007

Investigate the attack patterns behind CVE-2026-53777

Casky has 331 skills that investigate the attack patterns behind CVE-2026-53777. Run one and get CVSS-scored findings in 3 minutes.

Run the skill that detects this →

X Instagram LinkedIn