@google/clasp vulnerable to unsafe path traversal cloning or pulling a malicious script

Impact

Allows an attacker to perform a "Path Traversal" attack to modify files outside the projects directory, potentially allowing for running attacker code on the developer's machine.

Patches

Fixed in version 3.2.0

Workarounds

• Only clone or pull scripts from trusted sources
• Review the output of the pull and clone commands to verify only expected project files are modified