Pulpy is a cross-platform desktop application packager that injects a pulpy.fs JavaScript API into packaged web apps, granting them filesystem access. Before version 0.1.1, the validateFsPath() function intended to sandbox this access relied on an incomplete blocklist, enabling path traversal attacks. Consequently, any web app packaged with vulnerable Pulpy versions can read and write arbitrary files in the user's home directory, including critical files such as ~/.ssh/id_rsa, ~/.aws/credentials, and ~/Library/Keychains/. This vulnerability is identified as CWE-22 (Improper Limitation of a Pathname to a Restricted Directory) and CWE-284 (Improper Access Control). The issue is resolved in Pulpy 0.1.1. Since Pulpy is a cloud service, the vendor handles remediation server-side.

The vulnerability allows unauthorized read and write access to arbitrary files in the user's home directory via packaged web applications, potentially exposing sensitive credentials and private keys. This can lead to severe confidentiality and integrity breaches. The CVSS score of 9.3 reflects the critical nature of this flaw with network attack vector, low attack complexity, no privileges required, user interaction required, and high impact on confidentiality and integrity. Availability impact is not affected. No known exploits are reported in the wild.

A fix is available in Pulpy version 0.1.1. Since Pulpy is a cloud-hosted service, the vendor manages remediation server-side. Users and administrators should ensure they are using Pulpy 0.1.1 or later. Check the vendor advisory for confirmation of patch deployment and further guidance. No additional action is required if already on the fixed version.