CVE-2026-89065 in projen
Summary
by MITRE • 09/11/2026
Relative path traversal in the generated file manifest cleanup component in projen before 0.101.37 might allow context-dependent attackers to recursively delete files and directories outside the project directory that are writable by the environment running projen, via crafted entries in the version-controlled generated file manifest that is consumed during project synthesis.
To remediate this issue, users should upgrade to version 0.101.37. The corrected containment check is automatically applied by the projen runtime next time you run it.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 09/11/2026
The vulnerability identified in versions of projen prior to 0.101.37 represents a critical relative path traversal flaw within the file manifest cleanup component, which poses significant risks to system integrity and data confidentiality. Projen is a software generator for project configurations that synthesizes files based on defined parameters, maintaining an internal manifest to track generated artifacts. The security failure occurs during the execution of this synthesis process when the tool attempts to clean up obsolete or modified files by referencing entries in its version-controlled generated file manifest. An attacker with context-dependent access can manipulate these manifest entries to include paths that utilize relative directory traversal sequences, such as dot-dot-slash notation, effectively bypassing intended containment boundaries. This manipulation allows the cleanup routine to interpret maliciously crafted path strings not just within the project root but extending into parent directories or other writable locations on the host system where projen is executed.
From a technical perspective, this flaw stems from insufficient validation of file paths before performing deletion operations. The runtime fails to canonicalize or strictly validate that the target files reside exclusively within the expected project directory structure. Consequently, when the cleanup logic processes entries containing crafted relative paths, it resolves them against the current working directory without adequate boundary checks. This lack of strict path normalization enables recursive deletion of arbitrary files and directories outside the intended scope, provided those targets are writable by the user or service account running projen. The impact is severe, as an attacker could potentially delete critical system configuration files, application binaries, or other project assets located in adjacent directories, leading to denial of service through data loss or creating conditions for further exploitation if sensitive configurations are removed.
This vulnerability aligns with CWE-22: Improper Limitation of a Pathname to a Restricted Directory, as the software does not properly restrict file operations to an expected directory hierarchy. Furthermore, it relates to CWE-732: Incorrect Permission Assignment for Critical Resource, because the exploitation relies on the permissions granted to the environment running projen allowing write access to target locations outside the project root. In terms of offensive security frameworks, this behavior mirrors techniques found in MITRE ATT&CK under T1083: File and Directory Discovery or more specifically T1485: Data Destruction, where an adversary modifies system state by deleting files to disrupt operations or cover tracks. The context-dependent nature means that exploitation requires some level of interaction with the project configuration or manifest generation process, making it particularly dangerous in automated CI/CD pipelines or developer workstations where projen is frequently invoked.
To mitigate this risk and restore secure operation, organizations must upgrade immediately to version 0.101.37 or later of projen. The updated release implements a corrected containment check that rigorously validates file paths during the cleanup phase, ensuring that no operations can escape the designated project directory boundary regardless of how manifest entries are constructed. This fix is applied automatically by the projen runtime upon execution in subsequent sessions after upgrading. It is imperative for development teams to verify their dependency management systems reflect this version update and to re-run synthesis processes on affected projects to regenerate manifests with secure path handling logic. Regular auditing of generated file lists and restricting write permissions where possible can provide additional layers of defense against similar traversal-based attacks in future iterations or related tools.