CVE-2026-89065: Relative path traversal in the generated file manifest cleanup component in projen
Relative path traversal in the generated file manifest cleanup component in projen before 0.101.37 might allow context-dependent attackers to recursively delete files and directories outside the project directory that are writable by the environment running projen, via crafted entries in the version-controlled generated file manifest that is consumed during project synthesis.
To remediate this issue, users should upgrade to version 0.101.37. The corrected containment check is automatically applied by the projen runtime next time you run it.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
projento a version that resolves this vulnerability.Fixed in 0.101.37
Event History
Frequently Asked Questions
Who is exposed to this issue?
Environments running projen before 0.101.37 are exposed when project synthesis consumes a version-controlled generated file manifest containing crafted entries. Files and directories outside the project directory are at risk only if they are writable by the environment running projen.
What does an attacker need to exploit it?
An attacker needs to cause crafted relative-path entries to be present in the version-controlled generated file manifest that projen consumes during project synthesis. Exploitation also requires a user or automation environment to run projen with access to writable locations outside the project directory.
What should teams do if they cannot patch immediately?
Do not run projen synthesis against untrusted or unreviewed changes to the version-controlled generated file manifest. Limit write permissions available to the account or automation environment that runs projen, particularly for directories outside the project workspace.
How can teams determine whether they may already be affected?
Review uses of projen before version 0.101.37 and inspect the version-controlled generated file manifest for suspicious relative path entries that could resolve outside the project directory. Also review project-synthesis execution environments for unexpected deletion of writable files or directories outside the workspace.
When does the fix take effect after upgrading?
Upgrade to projen version 0.101.37. The corrected containment check is applied automatically by the projen runtime the next time it is run.