Product:
Clasp
Summary
Path Traversal in Clasp impacting versions < 3.2.0 allows a remote attacker to perform remote code execution via a malicious Google Apps Script project containing specially crafted filenames with directory traversal sequences.
Details
| Severity | Base Score | CVE |
|---|---|---|
| HIGH | 8.7 | CVE-2026-4092 |
Exploitation
An attacker can exploit this vulnerability by creating a malicious Google Apps Script project that includes specially crafted filenames containing directory traversal sequences. When this project is executed, it can lead to remote code execution on the affected system, allowing the attacker to gain unauthorized access and control.
Affected Products
- Clasp versions < 3.2.0: Vulnerable to remote code execution due to path traversal issues.
Mitigation
To mitigate this vulnerability, users should upgrade to Clasp version 3.2.0 or later. Additionally, it is recommended to review and sanitize any filenames used in Google Apps Script projects to prevent potential exploitation.