@google/clasp vulnerable to unsafe path traversal cloning or pulling a malicious script

HIGH 8.8CVE-2026-4092 · GHSA-hqjg-pww4-pcgq · Published 13/03/2026 · updated 17/06/2026

In short

CVE-2026-4092 is a HIGH (CVSS 8.8) vulnerability affecting clasp (google), @google/clasp.
Chance of exploitation in the next 30 days (EPSS): 0.47%, higher than 41.1% of all vulnerabilities.
Fix: update to 3.2.0 or later.

Package	Affected versions	Patched versions
clasp google	`< 3.2.0`	`3.2.0`
@google/clasp npm	`< 3.2.0`	`3.2.0`

Description

Impact

Allows an attacker to perform a "Path Traversal" attack to modify files outside the projects directory, potentially allowing for running attacker code on the developer's machine.

Patches

Fixed in version 3.2.0

Workarounds

Only clone or pull scripts from trusted sources
Review the output of the pull and clone commands to verify only expected project files are modified

NVD description

Path Traversal in Clasp impacting versions < 3.2.0 allows a remote attacker to perform remote code execution via a malicious Google Apps Script project containing specially crafted filenames with directory traversal sequences.

References

google/clasp security advisory · WEB
nvd.nist.gov/vuln/detail/CVE-2026-4092 · ADVISORY
google/clasp#1109 · WEB
google/clasp commit ba6bd66 · WEB
google/clasp · PACKAGE
google/clasp release v3.2.0 · WEB

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free