CVE-2026-44225

{
  "id": "CVE-2026-44225",
  "sourceIdentifier": "[email protected]",
  "published": "2026-05-12T20:16:43.427",
  "lastModified": "2026-10-26T18:10:00.173",
  "vulnStatus": "Deferred",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Pulpy is a lightweight, cross-platform desktop application packager for web apps. Prior to 0.1.1, Pulpy injects a pulpy.fs JavaScript API into every packaged web application, giving it access to the host filesystem. A validateFsPath() function is supposed to sandbox this access, but its blocklist is incomplete. Any web app packaged with Pulpy can read and write arbitrary files in the user's home directory — including ~/.ssh/id_rsa, ~/.aws/credentials, and ~/Library/Keychains/. This vulnerability is fixed in 0.1.1."
    },
    {
      "lang": "es",
      "value": "Pulpy es un empaquetador de aplicaciones de escritorio ligero y multiplataforma para aplicaciones web. Antes de la versión 0.1.1, Pulpy inyecta una API JavaScript pulpy.fs en cada aplicación web empaquetada, dándole acceso al sistema de archivos del host. Se supone que una función validateFsPath() debe aplicar un sandbox a este acceso, pero su lista de bloqueo está incompleta. Cualquier aplicación web empaquetada con Pulpy puede leer y escribir archivos arbitrarios en el directorio de inicio del usuario - incluyendo ~/.ssh/id_rsa, ~/.aws/credentials y ~/Library/Keychains/. Esta vulnerabilidad está corregida en la versión 0.1.1."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "enesgkky",
          "product": "Pulpy",
          "versions": [
            {
              "version": "< 0.1.1",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "[email protected]",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N",
          "baseScore": 9.3,
          "baseSeverity": "CRITICAL",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "NONE",
          "userInteraction": "REQUIRED",
          "scope": "CHANGED",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "availabilityImpact": "NONE"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 5.8
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-05-14T12:31:19.495018Z",
          "id": "CVE-2026-44225",
          "options": [
            {
              "exploitation": "poc"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "[email protected]",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-22"
        },
        {
          "lang": "en",
          "value": "CWE-284"
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://github.com/enesgkky/Pulpy/security/advisories/GHSA-h9q2-w73v-g7hf",
      "source": "[email protected]"
    },
    {
      "url": "https://github.com/enesgkky/Pulpy/security/advisories/GHSA-h9q2-w73v-g7hf",
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"
    }
  ]
}