AIKIDO-2026-10144

TL;DR

Affected versions of this package allow a path traversal vulnerability in the fetchRemote method, where unvalidated remote filenames could escape the intended project directory and write arbitrary files on the local filesystem. An attacker controlling a remote Apps Script project could craft filenames containing traversal sequences (e.g., ../../) so that, during a clasp pull or clasp clone, malicious files are written outside the project boundary, potentially overwriting sensitive files or planting executable code, leading to local arbitrary file write and a viable Remote Code Execution (RCE) vector.