CVE-2025-9118 — Dataform Path Traversal
A path traversal vulnerability in the NPM package installation process of Google Cloud Dataform allows a remote attacker to read and write files in other customers' repositories…
Published: 2025-08-25 · CVSS: 10.0 · CVSS 4.0
A path traversal vulnerability in the NPM package installation process of Google Cloud Dataform allows a remote attacker to read and write files in other customers' repositories via a maliciously crafted package.json file.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7