CVE-2026-4092: 
JavaScript vulnerability analysis and mitigation

CVE-2026-4092 is a path traversal vulnerability in @google/clasp (the command-line tool for Google Apps Script) that enables remote code execution on a developer's local machine. It affects all versions of @google/clasp prior to 3.2.0. An attacker who controls a remote Google Apps Script project can embed specially crafted filenames containing directory traversal sequences (e.g., ../../) that, when a victim runs clasp pull or clasp clone, cause files to be written outside the intended project directory. The vulnerability was disclosed on March 13, 2026, with a CVSS v3.1 score of 8.8 (High) and a CVSS v4.0 score of 8.7 (High) (GitHub Advisory, Feedly).

The root cause is CWE-22 (Improper Limitation of a Pathname to a Restricted Directory), specifically in the fetchRemote method of the Files class within src/core/files.ts (GitHub PR #1109). When clasp pull or clasp clone retrieves files from a remote Apps Script project, remote filenames were passed to path.resolve without first validating that the resulting absolute path remained within the intended project content directory (contentDir). An attacker controlling the remote project can craft filenames such as ../../.bashrc or ../../.ssh/authorized_keys, causing clasp to write attacker-controlled content to arbitrary locations on the victim's filesystem. The fix introduced an isInside helper using path.relative to mathematically verify that all resolved paths remain within the absoluteContentDir security boundary, throwing a Security Error on violation (GitHub PR #1109).

Successful exploitation allows an attacker to write arbitrary files anywhere on the victim developer's local filesystem with the permissions of the user running clasp. This can lead to full remote code execution — for example, by overwriting shell configuration files (.bashrc, .profile), SSH authorized keys, or placing malicious executables in directories on the user's PATH. All three security pillars are affected: confidentiality (sensitive files can be overwritten or exfiltrated indirectly), integrity (arbitrary file modification), and availability (system files could be corrupted). The impact is limited to the vulnerable system (the developer's workstation) and does not directly affect subsequent systems, though a compromised developer machine could serve as a pivot point into broader infrastructure (GitHub Advisory).

A GitHub repository (https://github.com/g0w6y/CVE-2026-4092) has been identified as a potential PoC, though Feedly's analysis assessed it as non-exploitable with high confidence, noting the repository lacked meaningful exploit content at the time of review (Feedly). No confirmed in-the-wild exploitation has been reported, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.013 (1.3%), indicating a low near-term exploitation probability. Exploitation requires user interaction — a developer must run clasp pull or clasp clone against a malicious project — but requires no privileges from the attacker's side (GitHub Advisory).

1. Create a malicious Apps Script project: The attacker creates or compromises a Google Apps Script project and adds script files with names containing path traversal sequences, such as ../../.bashrc or ../../.ssh/authorized_keys, with attacker-controlled content (e.g., a reverse shell command appended to .bashrc).
2. Share the project with the victim: The attacker shares the malicious Apps Script project with the target developer, or publishes it publicly and entices the developer to clone it (e.g., via a phishing link, a fake open-source library, or a compromised collaboration workspace).
3. Victim runs clasp clone or clasp pull: The developer executes clasp clone <scriptId> or clasp pull against the malicious project using a vulnerable version of @google/clasp (< 3.2.0).
4. Path traversal triggers file write: The fetchRemote method resolves the crafted filename without boundary validation, writing attacker-controlled content to the target path outside the project directory (e.g., overwriting ~/.bashrc with a reverse shell payload).
5. Code execution achieved: The next time the victim opens a terminal or the modified file is sourced, the injected payload executes with the victim's user privileges, potentially establishing persistence or a reverse shell (GitHub PR #1109, GitHub Advisory).

• File System: Unexpected modifications to files outside the clasp project directory following a clasp pull or clasp clone operation (e.g., changes to ~/.bashrc, ~/.profile, ~/.ssh/authorized_keys, or files in PATH directories); new or modified files with timestamps matching the time of a clasp operation.
• Logs: Shell history entries showing clasp clone <scriptId> or clasp pull followed shortly by unexpected process execution or outbound network connections; file system audit logs (e.g., auditd on Linux) recording writes to sensitive paths by the node or clasp process.
• Process: Unexpected child processes spawned from the user's shell after opening a new terminal session (e.g., curl, wget, bash -i, nc) that correlate with modified shell initialization files.
• Network: Outbound connections to unknown external IPs or domains originating from the developer's workstation shortly after a clasp operation, potentially indicating a reverse shell or beacon (GitHub PR #1109).

The primary remediation is to upgrade @google/clasp to version 3.2.0 or later, which includes the path traversal fix merged on January 31, 2026 (GitHub Advisory, GitHub PR #1109). Users can update via npm install -g @google/clasp@latest. As a workaround for those unable to upgrade immediately, only clone or pull scripts from fully trusted sources, and carefully review the output of clasp pull and clasp clone commands to verify that only expected project files within the project directory are modified (GitHub Advisory).

The vulnerability was discovered and reported by security researcher g0w6y, who also submitted the fix via GitHub Pull Request #1109, which was reviewed and merged by Google clasp maintainer sqrrrl (GitHub PR #1109). The issue was referenced in a Korean-language threat intelligence report by LEEKIYOON-SEC (Argus AI Threat Intelligence) highlighting arbitrary file write and RCE risks in Google clasp. Social media activity was noted on Bluesky shortly after disclosure. Overall community reaction was measured, consistent with the low EPSS score and absence of confirmed exploitation.