GHSA-hqjg-pww4-pcgq

@google/clasp vulnerable to unsafe path traversal cloning or pulling a malicious script

Source: GitHub Advisory Database (reviewed) High CVE-2026-4092

Packages

Ecosystem	Package	Affected	Fixed in
npm	@google/clasp	< 3.2.0	3.2.0

Details

As written in the advisory (Markdown source, shown as plain text).

### Impact Allows an attacker to perform a "Path Traversal" attack to modify files outside the projects directory, potentially allowing for running attacker code on the developer's machine. ### Patches Fixed in version 3.2.0 ### Workarounds * Only clone or pull scripts from trusted sources * Review the output of the `pull` and `clone` commands to verify only expected project files are modified

References

External links from the advisory. They lead to third-party sites.

https://github.com/google/clasp/security/advisories/GHSA-hqjg-pww4-pcgq web
https://nvd.nist.gov/vuln/detail/CVE-2026-4092 advisory
https://github.com/google/clasp/pull/1109 web
https://github.com/google/clasp/commit/ba6bd666fe74de54950122b5d92ecf1dcc02a9d3 web
https://github.com/google/clasp package
https://github.com/google/clasp/releases/tag/v3.2.0 web