CVE-2026-89065

Katalog CVE

CVSS 7.1 · High EPSS 0,19%

Kerentanan Relative Path Traversal. Skor CVSS 3.1 7.1 (High) menurut CNA.

Deskripsi (NVD)

Relative path traversal in the generated file manifest cleanup component in projen before 0.101.37 might allow context-dependent attackers to recursively delete files and directories outside the project directory that are writable by the environment running projen, via crafted entries in the version-controlled generated file manifest that is consumed during project synthesis. To remediate this issue, users should upgrade to version 0.101.37. The corrected containment check is automatically applied by the projen runtime next time you run it.

Rincian

Terbit di NVD

11 September 2026

Terakhir diubah

11 September 2026

Status NVD

Awaiting Analysis

CVSS 3.1

7.1 (High), sumber CNA
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-23: Relative Path Traversal

EPSS (30 hari)

0,19% peluang dieksploitasi; lebih tinggi dari 7,5% CVE lain

Produk dan versi terdampak

NVD belum mencantumkan data produk (CPE) untuk CVE ini. Produk yang terdampak biasanya disebut di deskripsi dan di advisory vendor pada daftar referensi.

Referensi dan perbaikan

• https://aws.amazon.com/security/security-bulletins/2026-108-aws/
• https://github.com/projen/projen/releases/tag/v0.101.37
• https://github.com/projen/projen/security/advisories/GHSA-7p65-6x86-v7f3