CVE-2026-4092: @google/clasp Path Traversal Vulnerability

HIGH
Advisory Identifier: GHSA-hqjg-pww4-pcgq
Share
CWE-22
Published
Advisory Summary

CVE-2026-4092 is a HIGH path traversal vulnerability (CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')) affecting @google/clasp libraries in the npm ecosystem. The issue involves @google/clasp vulnerable to unsafe path traversal cloning or pulling a malicious script. Remediation is available by upgrading affected packages to version 3.2.0.

CVE-2026-4092 at a Glance

CVE Identifier CVE-2026-4092
GHSA Identifier GHSA-hqjg-pww4-pcgq
Severity HIGH
CVSS v3.1 Base Score N/A
CWE Classification CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Affected Product @google/clasp
Package Ecosystem npm
Published Date
Last Updated

How to Fix CVE-2026-4092

To remediate this vulnerability, upgrade all affected @google/clasp dependencies to a patched release. Both direct and transitive dependencies should be checked, as frameworks or security libraries may pull in vulnerable versions transitively.

@google/clasp fixed: 3.2.0 
npm install @google/clasp@3.2.0
Verify Direct and Transitive Dependencies

Run the following command in your project directory to verify that all resolved dependencies use the patched release: 

npm ls @google/clasp

How to Check if You Are Affected

To determine whether your Node.js application is affected by CVE-2026-4092, inspect your project dependencies using npm:

npm ls @google/clasp

Analyze the terminal output to locate any version of @google/clasp in your dependency tree. If any resolved version matches the vulnerable ranges listed in the table below (for example, versions earlier than 3.2.0), your application is affected.

Note: The npm ls @google/clasp command inspects dependencies declared in your package.json and lockfile; it does not perform automated runtime dynamic scanning.

Technical Details

Vulnerability Mechanism & Technical Analysis

This vulnerability is classified under CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'), where the product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory. In @google/clasp, software state validation or input boundaries are circumvented during processing. Review the official source advisory statement below for specific affected components, classes, and reproduction details.

Source Advisory Statement

### Impact Allows an attacker to perform a "Path Traversal" attack to modify files outside the projects directory, potentially allowing for running attacker code on the developer's machine. ### Patches Fixed in version 3.2.0 ### Workarounds * Only clone or pull scripts from trusted sources * Review the output of the `pull` and `clone` commands to verify only expected project files are modified

CVE-2026-4092 Affected @google/clasp Versions

1 component(s)
Fixed Versions:
3.2.0
Product / Package Ecosystem Affected Versions Fixed Version
@google/clasp
npm/@google/clasp
npm
< 3.2.0
3.2.0

References

GitHub Advisory / Wiki ADVISORY
https://github.com/google/clasp/security/advisories/GHSA-hqjg-pww4-pcgq
NVD — CVE-2026-4092 NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-4092
@google/clasp Source Repository REPOSITORY
https://github.com/google/clasp/pull/1109
Security Fix Commit FIX COMMIT
https://github.com/google/clasp/commit/ba6bd666fe74de54950122b5d92ecf1dcc02a9d3
@google/clasp Source Repository REPOSITORY
https://github.com/google/clasp
@google/clasp Release RELEASE
https://github.com/google/clasp/releases/tag/v3.2.0

Frequently Asked Questions

What is CVE-2026-4092?
CVE-2026-4092 is a security vulnerability in @google/clasp involving @google/clasp vulnerable to unsafe path traversal cloning or pulling a malicious script under CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal').
Which @google/clasp versions are affected?
Affected versions include releases prior to 3.2.0 across affected packages: @google/clasp.
What version fixes CVE-2026-4092?
Upgrading to 3.2.0 (or the latest patched release for your respective branch) resolves the vulnerability.
Is @google/clasp affected?
Yes, @google/clasp is affected in releases prior to 3.2.0. Upgrade your dependency to 3.2.0 or later.
What CWE is associated with CVE-2026-4092?
CVE-2026-4092 is classified under CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.).
How can I check npm dependencies for CVE-2026-4092?
Run the dependency tree command: 'npm ls @google/clasp'. This command lists direct and transitive dependencies in your build configuration so you can verify if a vulnerable version is resolved.
Machine-readable OSV JSON OSV v1.5 Schema
Normalized schema output
View Raw JSON 
{
  "schema_version" : "1.4.0",
  "id" : "GHSA-hqjg-pww4-pcgq",
  "modified" : "2026-03-16T17:08:21Z",
  "published" : "2026-03-13T20:57:29Z",
  "aliases" : [ "CVE-2026-4092" ],
  "summary" : "@google/clasp vulnerable to unsafe path traversal cloning or pulling a malicious script",
  "details" : "### Impact\nAllows an attacker to perform a \"Path Traversal\" attack to modify files outside the projects directory, potentially allowing for running attacker code on the developer's machine.\n\n### Patches\nFixed in version 3.2.0\n\n### Workarounds\n* Only clone or pull scripts from trusted sources\n* Review the output of the `pull` and `clone` commands to verify only expected project files are modified",
  "severity" : [ {
    "type" : "CVSS_V4",
    "score" : "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N"
  } ],
  "affected" : [ {
    "package" : {
      "ecosystem" : "npm",
      "name" : "@google/clasp"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "0"
      }, {
        "fixed" : "3.2.0"
      } ]
    } ]
  } ],
  "references" : [ {
    "type" : "WEB",
    "url" : "https://github.com/google/clasp/security/advisories/GHSA-hqjg-pww4-pcgq"
  }, {
    "type" : "ADVISORY",
    "url" : "https://nvd.nist.gov/vuln/detail/CVE-2026-4092"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/google/clasp/pull/1109"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/google/clasp/commit/ba6bd666fe74de54950122b5d92ecf1dcc02a9d3"
  }, {
    "type" : "PACKAGE",
    "url" : "https://github.com/google/clasp"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/google/clasp/releases/tag/v3.2.0"
  } ],
  "database_specific" : {
    "cwe_ids" : [ "CWE-22" ],
    "severity" : "HIGH",
    "github_reviewed" : true,
    "github_reviewed_at" : "2026-03-13T20:57:29Z",
    "nvd_published_at" : "2026-03-13T19:55:13Z"
  }
}