Pulpy
Monthly
Path traversal sandbox escape in Pulpy (versions prior to 0.1.1), a cross-platform desktop packager for web apps, lets any packaged web application read and write arbitrary files in the user's home directory via the injected pulpy.fs JavaScript API. The validateFsPath() sandbox relies on an incomplete blocklist, so a malicious or compromised packaged app can exfiltrate secrets such as ~/.ssh/id_rsa, ~/.aws/credentials, and macOS keychains. Publicly available exploit code exists (Exploit-DB 52616), though EPSS remains very low at 0.04%.
Path traversal sandbox escape in Pulpy (versions prior to 0.1.1), a cross-platform desktop packager for web apps, lets any packaged web application read and write arbitrary files in the user's home directory via the injected pulpy.fs JavaScript API. The validateFsPath() sandbox relies on an incomplete blocklist, so a malicious or compromised packaged app can exfiltrate secrets such as ~/.ssh/id_rsa, ~/.aws/credentials, and macOS keychains. Publicly available exploit code exists (Exploit-DB 52616), though EPSS remains very low at 0.04%.