Executive brief
Pulpy is a tool used to package web applications into desktop software. A security flaw allows these packaged applications to bypass security restrictions and access sensitive files on the user's computer. An attacker could use this to steal private data such as SSH keys, cloud credentials, and saved passwords without the user's knowledge.
Technical details
A path traversal and improper access control vulnerability exists in Pulpy's 'pulpy.fs' JavaScript API bridge. The 'validateFsPath()' function, intended to sandbox filesystem access, utilizes an incomplete blocklist that only checks for root-level system directories (e.g., /etc, /var, /System). Because it fails to account for user-relative paths or home directory subdirectories, a packaged web application can access sensitive files such as ~/.ssh/id_rsa, ~/.aws/credentials, and keychain databases. An attacker can exploit this by distributing a malicious packaged app; when a user runs the app, it can exfiltrate or overwrite files with the user's privileges. The vulnerability is addressed in version 0.1.1 by replacing the blocklist with a strict allowlist.
Affected products
- enesgkky Pulpy < 0.1.1
Timeline
- 2026-04-27: advisory: GitHub security advisory published by developer
- 2026-05-12: disclosed: CVE published to NVD
- 2026-05-12: patched: Fixed in version 0.1.1