high8.7
CVE-2026-4092
@google/clasp vulnerable to unsafe path traversal cloning or pulling a malicious script
Impact
### Impact Allows an attacker to perform a "Path Traversal" attack to modify files outside the projects directory, potentially allowing for running attacker code on the developer's machine. ### Patches Fixed in version 3.2.0 ### Workarounds * Only clone or pull scripts from trusted sources * Review the output of the `pull` and `clone` commands to verify only expected project files are modified
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| npm | @google/clasp | < 3.2.0 | 3.2.0 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Clasp | before 3.2.0 |
Weakness classification
References
- NVD record
- CVE.org record
- GitHub advisory
- https://github.com/google/clasp/pull/1109
- https://github.com/advisories/GHSA-hqjg-pww4-pcgq
- https://github.com/google/clasp/security/advisories/GHSA-hqjg-pww4-pcgq
- https://nvd.nist.gov/vuln/detail/CVE-2026-4092
- https://github.com/google/clasp/commit/ba6bd666fe74de54950122b5d92ecf1dcc02a9d3
- https://github.com/google/clasp/releases/tag/v3.2.0