Incomplete filesystem sandbox bypass in Pulpy pulpy.fs bridge (CVE-2026-44225)

Pulpy injects a pulpy.fs JavaScript API into every packaged web application, granting it access to the host filesystem via a validateFsPath() function intended to sandbox that access. The function's blocklist is incomplete: it only blocks paths beginning with root-level directories such as /etc/, /var/, /usr/, /System/, and /Library/, leaving the user's home directory entirely unguarded. Any web app packaged with Pulpy can read and write arbitrary files in the user's home directory - including ~/.ssh/id_rsa, ~/.aws/credentials, and ~/Library/Keychains/ - without privilege escalation, enabling credential theft and persistent backdoor installation via file overwrite. Public POC available. Affected versions: - <= 0.1.1-Beta We recommend updating to: 0.1.1. CVSS 9.3 · our assessment: act_now Reference: https://github.com/enesgkky/Pulpy/security/advisories/GHSA-h9q2-w73v-g7hf Details: https://vuln.today/cve/CVE-2026-44225