VULNERABILITY INTELLIGENCE
CVE-2025-9118
EPSS probability0.68%
CISA KEVNot currently listed
Published2025-08-25
Last modified2026-06-17
Description
A path traversal vulnerability in the NPM package installation process of Google Cloud Dataform allows a remote attacker to read and write files in other customers' repositories via a maliciously crafted package.json file.
Weakness classification
- f45cbf4e-4146-4068-b7e1-655ffc2c548c: CWE-22