CVE-2026-4092
CVE-2026-4092 · Arbitrary File Write via Path Traversal in Google clasp leading to RCE
This page contains facts from public vulnerability sources. Check the original advisory before updating.
Path Traversal in Clasp impacting versions < 3.2.0 allows a remote attacker to perform remote code execution via a malicious Google Apps Script project containing specially crafted filenames with directory traversal sequences.
CVSS 8.7 · High · EPSS 0.5% · Fix available
- Published
- Updated
Stack: node
Affected products and versions
clasp
- Versions
- < 3.2.0: Affected
No fix published
@google/clasp npm
- Affected ranges
- SEMVER: < 3.2.0
Update to 3.2.0