@google/clasp vulnerable to unsafe path traversal cloning or pulling a malicious script

Description

Allows an attacker to perform a “Path Traversal” attack to modify files outside the projects directory, potentially allowing for running attacker code on the developer’s machine.

Recommendation

Update the @google/clasp package to the latest compatible version. Followings are version details:

• Affected version(s): < 3.2.0
• Patched version(s): 3.2.0

References

• GHSA-hqjg-pww4-pcgq
• CVE-2026-4092
• CWE-22
• CAPEC-310
• OWASP 2021-A1
• OWASP 2021-A6

Related Issues

• Parse Server: `PagesRouter` path traversal allows reading files outside configured pages directory - CVE-2026-30848
• Rollup 4 has Arbitrary File Write via Path Traversal - CVE-2026-27606
• nanotar is vulnerable to path traversal in parseTar() and parseTarGzip() - CVE-2025-69874
• ApostropheCMS has Arbitrary File Write (Zip Slip / Path Traversal) in Import-Export Gzip Extraction - CVE-2026-32731

Tags:

npm

@google/clasp