PT-2026-40423 · Pulpy · Pulpy

Published 2026-05-12 · Updated 2026-05-14 · CVE-2026-44225

Positive Technologies (AI Summary)

CVSS v3.1

9.3

Critical

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions Pulpy versions prior to 0.1.1

Description Pulpy injects a pulpy.fs JavaScript API into packaged web applications to provide host filesystem access. The validateFsPath() function, intended to sandbox this access, contains an incomplete blocklist. This allows any packaged web application to read and write arbitrary files within the user's home directory, such as ~/.ssh/id rsa, ~/.aws/credentials, and ~/Library/Keychains/.

Recommendations Update to version 0.1.1.

Exploit

Fix

Path traversal

Improper Access Control

Weakness Enumeration

CWE-22

CWE-284

Related Identifiers

CVE-2026-44225

Affected Products

Pulpy

References · 4

• 🔥 https://github.com/enesgkky/Pulpy/security/advisories/GHSA-h9q2-w73v-g7hf · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-44225 · Security Note
• https://t.me/cveNotify/163438 · Telegram Post
• https://twitter.com/CVEnew/status/2054324046549127180 · Twitter Post