What is GHSA-hqjg-pww4-pcgq?

GHSA-hqjg-pww4-pcgq is a security advisory published by GitHub Security Advisories with High severity. @google/clasp vulnerable to unsafe path traversal cloning or pulling a malicious script

Which CVE IDs does GHSA-hqjg-pww4-pcgq cover?

GHSA-hqjg-pww4-pcgq covers the following CVE IDs: CVE-2026-4092. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

Which products are affected by GHSA-hqjg-pww4-pcgq?

GHSA-hqjg-pww4-pcgq affects 1 product, including: npm/@google/clasp:\u003c 3.2.0.

GHSA-hqjg-pww4-pcgqHigh

@google/clasp vulnerable to unsafe path traversal cloning or pulling a malicious script

Vendor

GitHub Security Advisories

Published

March 13, 2026

Last Modified

March 16, 2026

🔗 CVE IDs covered (1)

CVE-2026-4092 →

📋 Description

Impact

Allows an attacker to perform a "Path Traversal" attack to modify files outside the projects directory, potentially allowing for running attacker code on the developer's machine.

Patches

Fixed in version 3.2.0

Workarounds

Only clone or pull scripts from trusted sources
Review the output of the pull and clone commands to verify only expected project files are modified

🎯 Affected products1

npm/@google/clasp:< 3.2.0

🔗 References (6)

https://github.com/google/clasp/security/advisories/GHSA-hqjg-pww4-pcgq
https://nvd.nist.gov/vuln/detail/CVE-2026-4092
https://github.com/google/clasp/pull/1109
https://github.com/google/clasp/commit/ba6bd666fe74de54950122b5d92ecf1dcc02a9d3
https://github.com/google/clasp/releases/tag/v3.2.0
https://github.com/advisories/GHSA-hqjg-pww4-pcgq