What is the CVSS score of EUVD-2026-29801?

EUVD-2026-29801 has a CVSS 3.1 base score of 9.3 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N. EPSS exploitation probability: 0.0%.

Which versions of Pulpy are affected by EUVD-2026-29801?

Pulpy, used to package web applications for desktop deployment, contains a critical sandbox escape in versions prior to 0.1.1 that allows any packaged application to directly access and exfiltrate…. A patch is available.

Is there a public PoC exploit available for EUVD-2026-29801?

Yes, a public proof-of-concept exploit is available for EUVD-2026-29801. Prioritise patching immediately. EPSS: 0.0%.

How to fix or mitigate EUVD-2026-29801?

Within 24 hours, create an inventory of all Pulpy installations and packaged applications deployed in your environment. Within 7 days, update all Pulpy instances to version 0.1.1 and conduct functional testing of packaged applications. Within 30 days, perform a comprehensive security audit to identify potentially exfiltrated credentials and execute rotation of all SSH keys, AWS credentials, and other secrets that may have been accessed during the affected period.

Pulpy EUVD-2026-29801

| CVE-2026-44225 CRITICAL

Path Traversal (CWE-22)

2026-05-12 GitHub_M

Path Traversal Pulpy

9.3

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

9.3 CRITICAL

AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N

vuln.today AI

9.3 CRITICAL

Requires the victim to run a Pulpy-packaged app (UI:R), no auth (PR:N), and the sandbox escape crosses into host files beyond the app (S:C) with full read/write (C:H/I:H) but no availability impact.

3.1 AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N

Primary rating from GitHub Advisory.

CVSS VectorGitHub Advisory

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

High

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 23, 2026 - 19:33 vuln.today

Patch available

May 12, 2026 - 21:03 EUVD

CVE Published

May 12, 2026 - 20:02 nvd

CRITICAL 9.3

DescriptionGitHub Advisory

Pulpy is a lightweight, cross-platform desktop application packager for web apps. Prior to 0.1.1, Pulpy injects a pulpy.fs JavaScript API into every packaged web application, giving it access to the host filesystem. A validateFsPath() function is supposed to sandbox this access, but its blocklist is incomplete. Any web app packaged with Pulpy can read and write arbitrary files in the user's home directory - including ~/.ssh/id_rsa, ~/.aws/credentials, and ~/Library/Keychains/. This vulnerability is fixed in 0.1.1.

AnalysisAI

Path traversal sandbox escape in Pulpy (versions prior to 0.1.1), a cross-platform desktop packager for web apps, lets any packaged web application read and write arbitrary files in the user's home directory via the injected pulpy.fs JavaScript API. The validateFsPath() sandbox relies on an incomplete blocklist, so a malicious or compromised packaged app can exfiltrate secrets such as ~/.ssh/id_rsa, ~/.aws/credentials, and macOS keychains. Publicly available exploit code exists (Exploit-DB 52616), though EPSS remains very low at 0.04%.

Technical ContextAI

Pulpy wraps web applications into native desktop apps and exposes a privileged pulpy.fs bridge that grants the embedded web content direct host filesystem access. The intended security boundary is validateFsPath(), a path-validation routine meant to confine reads and writes to a safe sandbox. This is a classic CWE-22 (Improper Limitation of a Pathname to a Restricted Directory / Path Traversal) failure: the function enforces a denylist rather than an allowlist canonicalization, and the denylist omits paths that resolve into the user's home directory. Because sensitive material like SSH private keys, cloud credentials, and OS keychains live at well-known home-directory paths, incomplete blocklisting collapses the trust boundary between untrusted web content and the host. The affected component is identified by CPE cpe:2.3:a:enesgkky:pulpy (vendor/author enesgkky).

RemediationAI

Vendor-released patch: upgrade Pulpy to version 0.1.1 or later, which corrects the validateFsPath() sandbox, and re-package and redistribute any apps built with a vulnerable version so end users receive the fixed runtime. Follow the vendor advisory at https://github.com/enesgkky/Pulpy/security/advisories/GHSA-h9q2-w73v-g7hf. Until upgrading, only package and run web applications from fully trusted sources, since any packaged app can abuse pulpy.fs; treat every Pulpy-packaged app as having full read/write access to the home directory. As compensating controls, avoid running Pulpy-packaged apps under accounts holding sensitive secrets, and relocate or tighten permissions on high-value files (~/.ssh/id_rsa, ~/.aws/credentials, ~/Library/Keychains/) - noting this may break tools that expect those default paths. These are stopgaps only; because the flaw is in the packager's filesystem bridge, upgrading to 0.1.1 is the sole complete fix.