Pulpy versions before 0.1.1 expose a path traversal vulnerability (CWE-22) through an incomplete blocklist in the validateFsPath() function of its pulpy.fs JavaScript API. This API is injected into every packaged web app, granting those apps filesystem access without proper sandboxing. As a result, any packaged web app can read and write arbitrary files within the user's home directory, including highly sensitive files like SSH private keys and AWS credentials. This vulnerability is addressed in Pulpy version 0.1.1. The CVSS 3.1 base score is 9.3, reflecting network attack vector, low attack complexity, no privileges required, user interaction required, scope changed, and high confidentiality and integrity impacts.

Exploitation allows an attacker to read and modify arbitrary files in the user's home directory on systems running vulnerable versions of Pulpy. This can lead to theft of sensitive credentials and private keys, potentially compromising user accounts and services. The vulnerability does not impact availability. No known exploits have been reported in the wild.

A fix is available in Pulpy version 0.1.1. Users should upgrade to this version or later to remediate the vulnerability. Since Pulpy is a cloud-hosted service, the vendor manages remediation server-side; users should verify with the vendor that the service is updated. No additional mitigation actions are indicated by the vendor advisory.