Path traversal in Gleam via unvalidated package application names

{
                    "cpes": [
                        "cpe:2.3:a:gleam-lang:gleam:*:*:*:*:*:*:*:*"
                    ],
                    "defaultStatus": "unaffected",
                    "modules": [
                        "gleam_cli::dependencies",
                        "gleam_core::manifest",
                        "gleam_core::paths",
                        "gleam_core::build::project_compiler",
                        "gleam_cli::fs"
                    ],
                    "packageName": "gleam",
                    "packageURL": "pkg:software-id/gleam.run/gleam",
                    "product": "Gleam",
                    "programFiles": [
                        "compiler-cli/src/dependencies.rs",
                        "compiler-core/src/manifest.rs",
                        "compiler-core/src/paths.rs",
                        "compiler-core/src/build/project_compiler.rs",
                        "compiler-cli/src/fs.rs"
                    ],
                    "programRoutines": [
                        {
                            "name": "gleam_cli::dependencies::hex_manifest_package"
                        },
                        {
                            "name": "gleam_core::manifest::ManifestPackage::application_name"
                        },
                        {
                            "name": "gleam_core::paths::ProjectPaths::build_directory_for_package"
                        },
                        {
                            "name": "gleam_core::build::project_compiler::ProjectCompiler::load_cache_or_compile_package"
                        },
                        {
                            "name": "gleam_cli::fs::delete_directory"
                        }
                    ],
                    "vendor": "Gleam",
                    "versions": [
                        {
                            "lessThan": "1.19.2",
                            "status": "affected",
                            "version": "0.32.4",
                            "versionType": "semver"
                        }
                    ]
                }

{
                    "collectionURL": "https://ghcr.io",
                    "cpes": [
                        "cpe:2.3:a:gleam-lang:gleam:*:*:*:*:*:*:*:*"
                    ],
                    "defaultStatus": "unaffected",
                    "modules": [
                        "gleam_cli::dependencies",
                        "gleam_core::manifest",
                        "gleam_core::paths",
                        "gleam_core::build::project_compiler",
                        "gleam_cli::fs"
                    ],
                    "packageName": "gleam-lang/gleam",
                    "packageURL": "pkg:oci/gleam?repository_url=ghcr.io%2Fgleam-lang",
                    "product": "Gleam",
                    "programFiles": [
                        "compiler-cli/src/dependencies.rs",
                        "compiler-core/src/manifest.rs",
                        "compiler-core/src/paths.rs",
                        "compiler-core/src/build/project_compiler.rs",
                        "compiler-cli/src/fs.rs"
                    ],
                    "programRoutines": [
                        {
                            "name": "gleam_cli::dependencies::hex_manifest_package"
                        },
                        {
                            "name": "gleam_core::manifest::ManifestPackage::application_name"
                        },
                        {
                            "name": "gleam_core::paths::ProjectPaths::build_directory_for_package"
                        },
                        {
                            "name": "gleam_core::build::project_compiler::ProjectCompiler::load_cache_or_compile_package"
                        },
                        {
                            "name": "gleam_cli::fs::delete_directory"
                        }
                    ],
                    "vendor": "Gleam",
                    "versions": [
                        {
                            "lessThan": "v1.19.2-elixir",
                            "status": "affected",
                            "version": "v0.32.4-elixir",
                            "versionType": "other"
                        },
                        {
                            "lessThan": "v1.19.2-erlang",
                            "status": "affected",
                            "version": "v0.32.4-erlang",
                            "versionType": "other"
                        },
                        {
                            "lessThan": "v1.19.2-node",
                            "status": "affected",
                            "version": "v0.32.4-node",
                            "versionType": "other"
                        },
                        {
                            "lessThan": "v1.19.2-node-slim",
                            "status": "affected",
                            "version": "v0.32.4-node-slim",
                            "versionType": "other"
                        },
                        {
                            "lessThan": "v1.19.2-elixir-slim",
                            "status": "affected",
                            "version": "v0.32.4-elixir-slim",
                            "versionType": "other"
                        },
                        {
                            "lessThan": "v1.19.2-erlang-slim",
                            "status": "affected",
                            "version": "v0.32.4-erlang-slim",
                            "versionType": "other"
                        },
                        {
                            "lessThan": "v1.19.2-erlang-alpine",
                            "status": "affected",
                            "version": "v0.32.4-erlang-alpine",
                            "versionType": "other"
                        },
                        {
                            "lessThan": "v1.19.2-elixir-alpine",
                            "status": "affected",
                            "version": "v0.32.4-elixir-alpine",
                            "versionType": "other"
                        },
                        {
                            "lessThan": "v1.19.2-node-alpine",
                            "status": "affected",
                            "version": "v0.32.4-node-alpine",
                            "versionType": "other"
                        },
                        {
                            "lessThan": "v1.19.2-scratch",
                            "status": "affected",
                            "version": "v0.32.4-scratch",
                            "versionType": "other"
                        }
                    ]
                }

{
                    "collectionURL": "https://github.com",
                    "cpes": [
                        "cpe:2.3:a:gleam-lang:gleam:*:*:*:*:*:*:*:*"
                    ],
                    "defaultStatus": "unaffected",
                    "modules": [
                        "gleam_cli::dependencies",
                        "gleam_core::manifest",
                        "gleam_core::paths",
                        "gleam_core::build::project_compiler",
                        "gleam_cli::fs"
                    ],
                    "packageName": "gleam-lang/gleam",
                    "packageURL": "pkg:github/gleam-lang/gleam",
                    "product": "Gleam",
                    "programFiles": [
                        "compiler-cli/src/dependencies.rs",
                        "compiler-core/src/manifest.rs",
                        "compiler-core/src/paths.rs",
                        "compiler-core/src/build/project_compiler.rs",
                        "compiler-cli/src/fs.rs"
                    ],
                    "programRoutines": [
                        {
                            "name": "gleam_cli::dependencies::hex_manifest_package"
                        },
                        {
                            "name": "gleam_core::manifest::ManifestPackage::application_name"
                        },
                        {
                            "name": "gleam_core::paths::ProjectPaths::build_directory_for_package"
                        },
                        {
                            "name": "gleam_core::build::project_compiler::ProjectCompiler::load_cache_or_compile_package"
                        },
                        {
                            "name": "gleam_cli::fs::delete_directory"
                        }
                    ],
                    "repo": "https://github.com/gleam-lang/gleam",
                    "vendor": "Gleam",
                    "versions": [
                        {
                            "changes": [
                                {
                                    "at": "d15c981fac6e533d70ac8ee89a6ef4dbf139adc3",
                                    "status": "unaffected"
                                },
                                {
                                    "at": "54bbb2b98af1505b6eed93c45b1936fc76412e5c",
                                    "status": "unaffected"
                                }
                            ],
                            "lessThan": "*",
                            "status": "affected",
                            "version": "d13f27ee80aae7a521d2e9433c4deaf53f892574",
                            "versionType": "git"
                        }
                    ]
                }