High · 8.7 CVE-2026-4092 EUVD-2026-12047GHSA-hqjg-pww4-pcgq

Arbitrary File Write via Path Traversal in Google clasp leading to RCE

Published Mar 13, 2026 · Updated Mar 16, 2026 · Assigned by Google

Vendor: Google Product: Clasp Package: @google/clasp Ecosystem: npm

Description

Path Traversal in Clasp impacting versions < 3.2.0 allows a remote attacker to perform remote code execution via a malicious Google Apps Script project containing specially crafted filenames with directory traversal sequences.

Affected products

Vendor	Product	Affected	Fixed
Google	Clasp	< 3.2.0	—

Affected packages

Ecosystem	Package	Affected	Fixed	Record
npm	@google/clasp	< 3.2.0	3.2.0	GHSA-hqjg-pww4-pcgq

References

https://github.com/google/clasp/pull/1109