@google/clasp vulnerable to unsafe path traversal cloning or pulling a malicious script

Description

Allows an attacker to perform a “Path Traversal” attack to modify files outside the projects directory, potentially allowing for running attacker code on the developer’s machine.

Recommendation

Update the @google/clasp package to the latest compatible version. Followings are version details:

• Affected version(s): < 3.2.0
• Patched version(s): 3.2.0

References

• GHSA-hqjg-pww4-pcgq
• CVE-2026-4092
• CWE-22
• CAPEC-310
• OWASP 2021-A1
• OWASP 2021-A6

Related Issues

• Vite Vulnerable to Path Traversal in Optimized Deps `.map` Handling - CVE-2026-39365
• Electerm runWidget has a path traversal that leads to arbitrary code execution - CVE-2026-43940
• PsiTransfer: Upload PATCH path traversal can create `config.<NODE_ENV>.js` and lead to code execution on restart - CVE-2026-41180
• i18next-http-middleware has path traversal / SSRF via user-controlled language and namespace parameters - CVE-2026-42353

You might also like:

Apache and Express Path Traversal plus Nginx Restriction Bypass Tests with SmartScanner

10 Secure Coding Best Practices to Follow in Every Project

Update Cheat Sheet for Developers

Tags:

npm

@google/clasp