CVE-2026-4092: @google/clasp Path Traversal Vulnerability Allows Malicious Script Execution
Summary
CVE-2026-4092: @google/clasp vulnerable to unsafe path traversal cloning or pulling a malicious script. Affects @google/clasp versions < 3.2.0. Fixed in 3.2.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The @google/clasp package is a command-line tool that enables developers to manage Google Apps Script projects directly from their terminal. It facilitates operations such as creating, pulling, and pushing scripts to Google Drive. However, this package is vulnerable to a path traversal attack, which can allow unauthorized file modifications outside the intended project directory.
Vulnerability Detail
The vulnerability arises from improper validation of file paths during cloning or pulling of scripts. An attacker can exploit this flaw to perform a path traversal attack, potentially modifying files outside the project directory. This could lead to the execution of malicious scripts on the developer's machine, posing significant security risks.
How To Fix
Latest published version: 3.4.1 as of 22 Oct 2026
npm install @google/clasp@3.4.1Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
3.2.0
This is the first release that contains the fix.
npm install @google/clasp@3.2.0Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, only clone or pull scripts from trusted sources. Additionally, review the output of the 'pull' and 'clone' commands to ensure that only expected project files are modified.
Conclusion
The @google/clasp package has a critical vulnerability (CVE-2026-4092) that allows for path traversal attacks, potentially enabling the execution of malicious scripts. It is crucial to update to the patched version 3.2.0 and follow recommended workarounds to mitigate risks.
See every vulnerability recorded for @google/clasp →
FAQ
A path traversal attack is a security vulnerability that allows an attacker to access files and directories that are stored outside the intended directory. This can lead to unauthorized file access and potential execution of malicious code.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time. By using the Vulert playground, you can check if your application is affected by this vulnerability without needing to sign up.
If exploited, this vulnerability can allow attackers to execute malicious scripts on a developer's machine, leading to data breaches, unauthorized access, and other security incidents.
Yes, you can mitigate the risk by only cloning or pulling scripts from trusted sources and carefully reviewing the output of the commands to ensure no unexpected files are modified.
The CVSS score of this vulnerability is 8.7, indicating a high severity level that requires immediate attention.
