Summary
Dataform could have allowed a malicious customer to gain unauthorized cross-tenant access
to other customer's code repositories and data. By preparing a maliciously crafted package.json
file, an attacker could exploit a path traversal vulnerability in the npm package installation
process, thereby gaining read and write access in other customers' repositories. According to
Google, there was no evidence of exploitation in the wild.
Affected Services
Dataform
Remediation
None required.
Tracked CVEs
CVE-2025-9118
References
Contributed by https://github.com/korniko98
Entry Status
Finalized
Disclosure Date
Thu, Aug 21st, 2025
Exploitablity Period
2025/08/07 to 2025/08/21
Known ITW Exploitation
-
Detection Methods
None
Piercing Index Rating
-
Discovered by
Unknown
