CVE-2026-44225 Overview
Pulpy is a lightweight, cross-platform desktop application packager for web applications. CVE-2026-44225 is a path traversal vulnerability [CWE-22] in versions prior to 0.1.1. Pulpy injects a pulpy.fs JavaScript API into every packaged web application, granting filesystem access to the host. A validateFsPath() function attempts to sandbox this access, but its blocklist is incomplete. Any web application packaged with Pulpy can read and write arbitrary files in the user's home directory. The vulnerability is fixed in version 0.1.1.
Critical Impact
Packaged web applications can read and write sensitive files including ~/.ssh/id_rsa, ~/.aws/credentials, and ~/Library/Keychains/, enabling credential theft and full account compromise.
Affected Products
- Pulpy versions prior to 0.1.1
- Web applications packaged with vulnerable Pulpy versions
- Cross-platform desktop builds (macOS, Linux, Windows) using the injected pulpy.fs API
Discovery Timeline
- 2026-05-12 - CVE-2026-44225 published to NVD
- 2026-05-14 - Last updated in NVD database
Technical Details for CVE-2026-44225
Vulnerability Analysis
Pulpy packages web applications into native desktop applications and exposes a pulpy.fs JavaScript API to the bundled web content. This API provides direct access to the host filesystem from within the packaged web context. The validateFsPath() function enforces a sandbox by rejecting path inputs that match a blocklist of restricted locations. The blocklist is incomplete, allowing crafted paths to escape the intended sandbox.
An attacker who controls or compromises the web content delivered inside a Pulpy-packaged application can invoke pulpy.fs calls to access files outside the intended scope. Targets include SSH private keys at ~/.ssh/id_rsa, cloud credentials at ~/.aws/credentials, and macOS keychains at ~/Library/Keychains/. Exploitation requires user interaction, such as launching the packaged application or loading attacker-controlled web content within it.
Root Cause
The root cause is incomplete input validation in validateFsPath(). The function relies on a denylist rather than a strict allowlist of permitted paths. Denylist-based path sandboxing fails to account for path normalization, symbolic links, and alternative path representations. This permits traversal sequences and absolute paths to bypass the check and resolve to sensitive user directories.
Attack Vector
The attack requires a user to run a Pulpy-packaged application that loads attacker-influenced web content. Once loaded, malicious JavaScript invokes pulpy.fs read and write methods with paths that bypass validateFsPath(). The attacker exfiltrates credentials over the network or writes malicious files to persistence locations. No authentication on the host is required because the API runs with the user's privileges.
Detection Methods for CVE-2026-44225
Indicators of Compromise
- Unexpected file reads against ~/.ssh/, ~/.aws/, or ~/Library/Keychains/ originating from a Pulpy-packaged application process.
- Outbound network connections from a Pulpy-packaged application carrying contents that resemble private keys or credential files.
- New or modified files written to user persistence locations by a process bundled with the Pulpy runtime.
Detection Strategies
- Inventory installed desktop applications and identify those built with Pulpy versions prior to 0.1.1.
- Monitor process file access telemetry for Pulpy-derived binaries touching credential paths outside their application data directory.
- Inspect packaged application bundles for references to pulpy.fs and verify the embedded Pulpy runtime version.
Monitoring Recommendations
- Enable file integrity monitoring on ~/.ssh/id_rsa, ~/.aws/credentials, and macOS keychain files.
- Alert on Electron-style or web-runtime processes performing reads on private key and credential files.
- Forward endpoint file access and process telemetry to a centralized SIEM or data lake for correlation across hosts.
How to Mitigate CVE-2026-44225
Immediate Actions Required
- Upgrade Pulpy to version 0.1.1 or later and rebuild all packaged applications.
- Audit currently installed desktop applications for those built with vulnerable Pulpy versions and remove or replace them.
- Rotate credentials that may have been exposed, including SSH keys, AWS access keys, and keychain-stored secrets.
Patch Information
The vulnerability is fixed in Pulpy version 0.1.1. Application developers must rebuild and redistribute their packaged applications using the patched release. Refer to the GitHub Security Advisory GHSA-h9q2-w73v-g7hf for technical details.
Workarounds
- Do not launch Pulpy-packaged applications from untrusted publishers until updated builds are available.
- Restrict filesystem permissions on sensitive files where the operating system supports per-application sandboxing.
- Network-isolate hosts that must run legacy Pulpy-packaged applications to limit credential exfiltration paths.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
