Skip to content
fr Sign in
10.0 Critical

CVE-2025-9118 A path traversal vulnerability in the NPM package installation process of Google Cloud Dataform allows a remote attacker…

Description

A path traversal vulnerability in the NPM package installation process of Google Cloud Dataform allows a remote attacker to read and write files in other customers' repositories via a maliciously crafted package.json file.

Affected products and versions

Product Affected versions Fixed in
Dataform Versions not published

References

Timeline

  1. Published
  2. Last modified

Other CVEs of Dataform

The 2 CVEs of Dataform →
CVE-2026-14934 A Missing Authorization vulnerability in the repository creation functionality in Google Cloud BigQuery, Dataform and… 9.4 Critical
Track this CVE