{"action":"Upgrade @google/clasp to 3.2.0 or later.","affected":[{"fixed":"3.2.0","introduced":"0"}],"component":"@google/clasp","cve_ids":["CVE-2026-4092"],"ecosystem":"npm","epss":0.00473,"exploited":false,"fixed_versions":["3.2.0"],"ghsa_id":"GHSA-hqjg-pww4-pcgq","id":"tcs_01M5KFVV7AAA2K7VRA20E8W5TH","modified_at":"2026-03-16T17:16:39.711134Z","published_at":"2026-03-13T20:57:29Z","references":["https://osv.dev/vulnerability/GHSA-hqjg-pww4-pcgq","https://github.com/google/clasp/security/advisories/GHSA-hqjg-pww4-pcgq","https://nvd.nist.gov/vuln/detail/CVE-2026-4092","https://github.com/google/clasp/pull/1109","https://github.com/google/clasp/commit/ba6bd666fe74de54950122b5d92ecf1dcc02a9d3","https://github.com/google/clasp","https://github.com/google/clasp/releases/tag/v3.2.0"],"severity":{"label":"high"},"sources":[{"source":"osv","source_id":"GHSA-hqjg-pww4-pcgq","url":"https://osv.dev/vulnerability/GHSA-hqjg-pww4-pcgq"}],"summary":"@google/clasp vulnerable to unsafe path traversal cloning or pulling a malicious script"}