CVE-2026-44225: enesgkky Pulpy, заобикаляне на вход и права

Описание

Оригинално описание

Pulpy is a lightweight, cross-platform desktop application packager for web apps. Prior to 0.1.1, Pulpy injects a pulpy.fs JavaScript API into every packaged web application, giving it access to the host filesystem. A validateFsPath() function is supposed to sandbox this access, but its blocklist is incomplete. Any web app packaged with Pulpy can read and write arbitrary files in the user's home directory — including ~/.ssh/id_rsa, ~/.aws/credentials, and ~/Library/Keychains/. This vulnerability is fixed in 0.1.1.

Засегнати продукти

• enesgkky Pulpy: < 0.1.1

Вид слабост

• CWE-22 Неправилно ограничаване на път до позволена директория
• CWE-284 Неправилен контрол на достъпа

История

Първоизточници

• https://www.cve.org/CVERecord?id=CVE-2026-44225
• https://nvd.nist.gov/vuln/detail/CVE-2026-44225
• https://github.com/enesgkky/Pulpy/security/advisories/GHSA-h9q2-w73v-g7hf