@google/clasp vulnerable to unsafe path traversal cloning or pulling a malicious script

ALTO 8.8CVE-2026-4092 · GHSA-hqjg-pww4-pcgq · Published 13/03/2026 · updated 17/06/2026

In breve

CVE-2026-4092 è una vulnerabilità ALTO (CVSS 8.8) che riguarda clasp (google), @google/clasp.
Probabilità di sfruttamento nei prossimi 30 giorni (EPSS): 0.47%, superiore al 41.1% delle vulnerabilità.
Correzione: aggiornare a 3.2.0 o successiva.

Package	Affected versions	Patched versions
clasp google	`< 3.2.0`	`3.2.0`
@google/clasp npm	`< 3.2.0`	`3.2.0`

Description

Impact

Allows an attacker to perform a "Path Traversal" attack to modify files outside the projects directory, potentially allowing for running attacker code on the developer's machine.

Patches

Fixed in version 3.2.0

Workarounds

Only clone or pull scripts from trusted sources
Review the output of the pull and clone commands to verify only expected project files are modified

NVD description

Path Traversal in Clasp impacting versions < 3.2.0 allows a remote attacker to perform remote code execution via a malicious Google Apps Script project containing specially crafted filenames with directory traversal sequences.

References

google/clasp security advisory · WEB
nvd.nist.gov/vuln/detail/CVE-2026-4092 · ADVISORY
google/clasp#1109 · WEB
google/clasp commit ba6bd66 · WEB
google/clasp · PACKAGE
google/clasp release v3.2.0 · WEB

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free