{"id":"CVE-2026-4092","aliases":["GHSA-hqjg-pww4-pcgq"],"url":"https://o3.security/vulnerability/CVE-2026-4092","summary":"Arbitrary File Write via Path Traversal in Google clasp leading to RCE","details":"### Impact\nAllows an attacker to perform a \"Path Traversal\" attack to modify files outside the projects directory, potentially allowing for running attacker code on the developer's machine.\n\n### Patches\nFixed in version 3.2.0\n\n### Workarounds\n* Only clone or pull scripts from trusted sources\n* Review the output of the `pull` and `clone` commands to verify only expected project files are modified","published":"2026-03-13T15:44:55.099Z","modified":"2026-10-28T02:30:44.808724947Z","cvss":null,"epss":null,"cisaKev":null,"exploitsKnown":0,"affectedPackages":[{"ecosystem":"npm","name":"@google/clasp","fixedVersion":"3.2.0"}],"fix":{"url":"https://github.com/google/clasp/pull/1109","label":"google/clasp#1109"},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/4xxx/CVE-2026-4092.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-4092"},{"type":"FIX","url":"https://github.com/google/clasp/pull/1109"},{"type":"WEB","url":"https://github.com/google/clasp/security/advisories/GHSA-hqjg-pww4-pcgq"},{"type":"WEB","url":"https://github.com/google/clasp/commit/ba6bd666fe74de54950122b5d92ecf1dcc02a9d3"},{"type":"PACKAGE","url":"https://github.com/google/clasp"},{"type":"WEB","url":"https://github.com/google/clasp/releases/tag/v3.2.0"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-10-28T02:30:44.808724947Z"}}