PT-2025-34599 · Google · Google Cloud Dataform

Tomas Lažauninkas · Published 2025-08-25 · Updated 2025-08-25 · CVE-2025-9118

Positive Technologies (AI Summary)

CVSS v4.0

10

Critical

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:H/SI:H/SA:H

Name of the Vulnerable Software and Affected Versions:

Google Cloud Dataform (affected versions not specified)

Description:

A path traversal vulnerability exists in the NPM package installation process of Google Cloud Dataform. A remote attacker can read and write files in other customers' repositories by using a maliciously crafted package.json file. No customer action is required as Google has already applied mitigations.

Recommendations:

At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2025-9118

Affected Products

Google Cloud Dataform

References · 12

• https://nvd.nist.gov/vuln/detail/CVE-2025-9118 · Security Note
• https://cloud.devsite.corp.google.com/dataform/docs/security-bulletins#gcp-2025-045 · Vendor Advisory
• https://twitter.com/CveFindCom/status/1959883414061961391 · Twitter Post
• https://twitter.com/BaseFortify/status/1959905876917309905 · Twitter Post
• https://t.me/cveNotify/133332 · Telegram Post
• https://twitter.com/UjlakiMarci/status/1959923485053956542 · Twitter Post
• https://twitter.com/DarkWebInformer/status/1960020639755956709 · Twitter Post
• https://twitter.com/CVEnew/status/1959881779210223911 · Twitter Post
• https://twitter.com/offseq/status/1959881100504776914 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1959884717521506634 · Twitter Post
• https://twitter.com/intheaetherr/status/1960026162542833749 · Twitter Post
• https://t.me/CVEtracker/30824 · Telegram Post