https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-20T05:16:11.393980+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/euvd-2026-276249 EUVD-2026-276249 2026-10-20T05:16:11.429544+00:00 EUVD-2026-276249 https://cve.radiocsirt.org/vuln/fkie_cve-2026-4092 fkie_cve-2026-4092 2026-10-20T05:16:11.429582+00:00

Path Traversal in Clasp impacting versions < 3.2.0 allows a remote attacker to perform remote code execution via a malicious Google Apps Script project containing specially crafted filenames with directory traversal sequences.

 https://cve.radiocsirt.org/vuln/ghsa-hqjg-pww4-pcgq GHSA-hqjg-pww4-pcgq — @google/clasp vulnerable to unsafe path traversal cloning or pulling a malicious script 2026-10-20T05:16:11.429616+00:00

Affected: npm: @google/clasp

### Impact Allows an attacker to perform a "Path Traversal" attack to modify files outside the projects directory, potentially allowing for running attacker code on the developer's machine.

### Patches Fixed in version 3.2.0

### Workarounds * Only clone or pull scripts from trusted sources * Review the output of the `pull` and `clone` commands to verify only expected project files are modified