critical
Dataform cross-tenant path traversal
Published Thu, Aug 21st, 2025
Platforms
Summary
Dataform could have allowed a malicious customer to gain unauthorized cross-tenant access to other customer's code repositories and data. By preparing a maliciously crafted package.json file, an attacker could exploit a path traversal vulnerability in the npm package installation process, thereby gaining read and write access in other customers' repositories. According to Google, there was no evidence of exploitation in the wild.
Affected Services
Dataform
Remediation
None required.
Tracked CVEs
CVE-2025-9118
References
Contributed by https://github.com/korniko98
Entry Status
Finalized
Disclosure Date
Thu, Aug 21st, 2025
Exploitability Period
2025/08/07 to 2025/08/21
Known ITW Exploitation
-
Detection Methods
None
Piercing Index Rating
-
Discovered by
Unknown
