CVE-2026-4092

CVE-2026-4092 is a path traversal vulnerability (CWE-22) in the Clasp tool, affecting versions prior to 3.2.0. Clasp, maintained by Google for interacting with Google Apps Script projects, fails to properly sanitize filenames containing directory traversal sequences, enabling a remote attacker to achieve remote code execution.

A remote attacker without privileges can exploit this vulnerability over the network with low complexity, though it requires user interaction. The scenario involves tricking a user into handling a malicious Google Apps Script project via Clasp, where specially crafted filenames with traversal sequences (such as ../) allow the attacker to write files outside intended directories and execute arbitrary code on the victim's system. Successful exploitation grants high confidentiality, integrity, and availability impacts, as reflected in the CVSS v3.1 base score of 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H).

Mitigation is addressed in the GitHub pull request at https://github.com/google/clasp/pull/1109, which corresponds to the release of Clasp version 3.2.0. Security practitioners should update to version 3.2.0 or later to patch the vulnerability and avoid processing untrusted Google Apps Script projects.