8.7

CVSS Score

4.0

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-4092

CVE-2026-4092: Arbitrary File Write via Path Traversal in Google clasp leading to RCE

Path Traversal in Clasp impacting versions < 3.2.0 allows a remote attacker to perform remote code execution via a malicious Google Apps Script project containing specially crafted filenames with directory traversal sequences.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-4092

CVE-2026-4092:

8.7

CVSS Score

4.0

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
@google/clasp	npm	< 3.2.0	3.2.0

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability is a path traversal issue within the @google/clasp tool, occurring when a user clones or pulls a malicious Google Apps Script project. The root cause is in the Files.fetchRemote method located in src/core/files.ts. This function is responsible for fetching files from the remote script project. Before the fix, it would construct the local path for each file using the file name provided by the remote project without proper sanitization. An attacker could create a project with file names like ../../foo/bar, causing the tool to write files outside the designated project folder. The patch, identified in commit ba6bd666fe74de54950122b5d92ecf1dcc02a9d3, introduces a security check by adding a new function isInside that verifies if the resolved file path is strictly within the project's content directory before any file operations occur. Therefore, any runtime profile capturing the exploitation of this vulnerability would show the Files.fetchRemote function as the entry point of the vulnerable operation.

Vulnerable functions

Files.fetchRemote

src/core/files.ts

The `fetchRemote` function in the `Files` class is responsible for fetching script project content from Google Drive. The vulnerability exists because the function constructs a local file path using `path.resolve` with a file name (`f.name`) obtained from the remote project. A malicious actor could craft a project with a file name containing path traversal sequences (e.g., `../../etc/passwd`). When the `clasp pull` or `clasp clone` command is executed, this function would resolve the malicious path and write the file outside of the intended project directory, leading to arbitrary file write.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.