The vulnerability is a path traversal flaw in Google Clasp that allows an attacker to craft malicious Google Apps Script project files with directory traversal sequences in the filenames. When such a project is uploaded or imported, Clasp writes the files to arbitrary locations on the host, enabling malicious code to be executed. This results in full remote code execution on the system where Clasp is running. The vulnerability is classified as CWE‑22, an improper validation of file names or paths.

All users of Google Clasp with installations of any version earlier than 3.2.0 are affected. The specific product is Google:Clasp. No additional products or versions are identified in the provided data.

The CVSS score of 8.7 indicates high severity, and the EPSS score of 1% suggests a relatively low but still possible exploitation probability. The vulnerability is not listed in the CISA KEV catalog. The likely attack vector is remote via the upload or import of a malicious Apps Script project, which can be automated, making exploitation feasible for an attacker who can deliver the crafted files to a target environment.