CVE Intelligence
Analysis AI-assisted

CVE-2026-44225: Pulpy Desktop Packager Path Traversal Exposes Home Directory Files

CVE-2026-44225 affects Pulpy, a cross-platform desktop packager for web apps, in versions prior to 0.1.1. According to the advisory, an incomplete blocklist in validateFsPath() lets any packaged web app read and write arbitrary files in the user's home directory. The record reports a CVSS 3.1 score of 9.3 and no confirmed exploitation in the sources consulted.

Published Oct 13, 2026 · Updated Oct 13, 2026 · Ler em português

Overview

Pulpy is a lightweight, cross-platform desktop application packager for web apps. According to the GitHub Security Advisory, versions prior to 0.1.1 inject a pulpy.fs JavaScript API into every packaged web application. A validateFsPath() function is meant to sandbox that API, but its blocklist is incomplete.

Impact

  • Any web app packaged with an affected Pulpy version can read and write arbitrary files in the user's home directory.
  • The advisory names examples including ~/.ssh/id_rsa, ~/.aws/credentials and ~/Library/Keychains/.
  • The CVSS 3.1 vector in the record indicates network attack vector, low complexity, no privileges required, user interaction required, scope changed, and high confidentiality and integrity impact.

Affected products and versions

  • Pulpy versions prior to 0.1.1 are described as affected.
  • The record contains an empty affected list and no CPE or version range data, so the precise lower bound of affected versions is unknown.

Exploitation status

The record shows this CVE is not listed in the CISA KEV catalog. No confirmed exploitation appears in the sources consulted. The record also includes an EPSS probability of 0.01398 and a percentile of 0.7176.

Remediation and mitigation

  • Upgrade Pulpy to version 0.1.1 or later, which the advisory states contains the fix.
  • Rebuild and redistribute web app packages produced with an older Pulpy version, since the injected API is part of the packaged output.
  • Until updates are applied, install packaged web apps only from trusted sources.

Detection guidance

  • Inventory systems where Pulpy-packaged applications are installed and record the Pulpy version of each.
  • Review unexpected reads or modifications of sensitive user files by desktop applications, such as SSH keys, cloud credentials and keychain stores.
  • If exposure is suspected, rotating the affected credentials is a general precaution, not a recommendation found in the record.

Limitations of the available information

  • The record does not describe the specific bypass technique or the exact blocklist entries that are missing, and this analysis does not add them.
  • No vendor workaround, fixed-version commit or structured list of affected products is provided.
  • The record lists the source status as Deferred, and its meaning is unknown.

Frequently asked questions

What does CVE-2026-44225 affect?

According to the record, Pulpy versions prior to 0.1.1 are affected. The record does not provide a structured list of affected products or version ranges.

Is this vulnerability being actively exploited?

The record shows the CVE is not listed in the CISA KEV catalog, and no confirmed exploitation appears in the sources consulted.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.