EUVD-2026-76150Severity by source
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Local vector because synthesis runs on developer machine; no privileges needed but user must actively run projen (UI:R); deletion-only impact means C:N, I:H/A:H.
Primary rating from Vendor (ff89ba41-3aa1-4d27-914a-91399e9639e5).
CVSS VectorVendor: ff89ba41-3aa1-4d27-914a-91399e9639e5
Lifecycle Timeline
3DescriptionCVE.org
Relative path traversal in the generated file manifest cleanup component in projen before 0.101.37 might allow context-dependent attackers to recursively delete files and directories outside the project directory that are writable by the environment running projen, via crafted entries in the version-controlled generated file manifest that is consumed during project synthesis.
To remediate this issue, users should upgrade to version 0.101.37. The corrected containment check is automatically applied by the projen runtime next time you run it.
AnalysisAI
Relative path traversal in projen's generated file manifest cleanup component allows recursive deletion of files and directories outside the project directory during project synthesis. Projen versions before 0.101.37 consume a version-controlled manifest of generated files; crafted entries with traversal sequences (e.g., '../..') cause the cleanup routine to delete writable paths beyond the project root when a developer runs projen. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires three concrete conditions: (1) the attacker must have write access to the version-controlled generated file manifest consumed by projen (typically achievable via repository contributor access, a compromised CI bot token, or a malicious upstream project template); (2) a developer or automated pipeline must run projen synthesis ('npx projen' or equivalent) against the tampered repository, satisfying the UI:A requirement; (3) files or directories targeted by the traversal entries must be writable by the OS user running the projen process. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 score of 6.8 (AV:L/AC:L/AT:N/PR:N/UI:A/VI:H/VA:H) appropriately reflects the local-execution model: exploitation requires a developer to actively run projen against a repository containing the malicious manifest. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Vendor-released patch: projen 0.101.37. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-23 – Relative Path Traversal
View allSame technique Path Traversal
View allShare
External POC / Exploit Code
Leaving vuln.today