EUVD-2026-12047
GHSA-hqjg-pww4-pcgq
CVSS Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Lifecycle Timeline
5Tags
Description
Path Traversal in Clasp impacting versions < 3.2.0 allows a remote attacker to perform remote code execution via a malicious Google Apps Script project containing specially crafted filenames with directory traversal sequences.
Analysis
Remote code execution in Clasp versions below 3.2.0 allows unauthenticated attackers to execute arbitrary code by uploading Google Apps Script projects with specially crafted filenames that exploit path traversal weaknesses. Public exploit code exists for this vulnerability, and no patch is currently available. …
Sign in for full analysis, threat intelligence, and remediation guidance.
Remediation
Within 24 hours: Inventory all systems running Clasp and identify critical dependencies; disable Clasp functionality where operationally feasible. Within 7 days: Implement network segmentation to restrict Clasp processes from accessing sensitive systems; enable enhanced logging on Google Workspace and Google Apps Script execution; review recent Clasp project uploads for suspicious activity. …
Sign in for detailed remediation steps.
Priority Score
Share
External POC / Exploit Code
Leaving vuln.today