CVE-2026-4092

Arbitrary File Write via Path Traversal in Google clasp leading to RCE PUBLISHED

Description (CNA)

Path Traversal in Clasp impacting versions < 3.2.0 allows a remote attacker to perform remote code execution via a malicious Google Apps Script project containing specially crafted filenames with directory traversal sequences.

Affected (CNA)

Vendor / product	Versions
Google / Clasp	affected < 3.2.0

CWE

CWE-22

References

https://github.com/google/clasp/pull/1109

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.