PT-2026-25324 · Npm+1 · @Google/Clasp+1

Leekiyoon-Sec · Published 2026-03-13 · Updated 2026-03-16 · CVE-2026-4092

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Clasp versions prior to 3.2.0

Description A path traversal issue exists in Clasp, potentially allowing a remote attacker to execute code on the developer's machine. This occurs through a malicious Google Apps Script project containing specially crafted filenames with directory traversal sequences. The issue allows an attacker to modify files outside the project directory, leading to potential remote code execution.

API Endpoints No API endpoints are mentioned in the provided descriptions.

Vulnerable Parameters or Variables Filenames within Google Apps Script projects are vulnerable.

Recommendations Update Clasp to version 3.2.0 or later. Only clone or pull scripts from trusted sources. Review the output of the pull and clone commands to verify only expected project files are modified.

Fix

RCE

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2026-4092

GHSA-HQJG-PWW4-PCGQ

Affected Products

@Google/Clasp

Clasp

References · 15

• https://github.com/google/clasp/pull/1109 · Patch
• https://osv.dev/vulnerability/GHSA-hqjg-pww4-pcgq · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-4092 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-4092 · Security Note
• https://github.com/google/clasp · Note
• https://github.com/google/clasp/commit/ba6bd666fe74de54950122b5d92ecf1dcc02a9d3 · Note
• https://github.com/google/clasp/releases/tag/v3.2.0 · Note
• https://github.com/google/clasp/security/advisories/GHSA-hqjg-pww4-pcgq · Note
• https://twitter.com/g0w6y/status/2033059403885379836 · Twitter Post
• https://twitter.com/ptdbugs/status/2032516179630191016 · Twitter Post
• https://twitter.com/TuringCyberObs/status/2033511112415563797 · Twitter Post
• https://twitter.com/g0w6y/status/2033058983767060919 · Twitter Post
• https://t.me/CVEtracker/47373 · Telegram Post
• https://twitter.com/CVEnew/status/2032831378749010079 · Twitter Post
• https://twitter.com/cyberbivash/status/2032548835399008560 · Twitter Post