Description

Relative path traversal in the generated file manifest cleanup component in projen before 0.101.37 might allow context-dependent attackers to recursively delete files and directories outside the project directory that are writable by the environment running projen, via crafted entries in the version-controlled generated file manifest that is consumed during project synthesis. To remediate this issue, users should upgrade to version 0.101.37. The corrected containment check is automatically applied by the projen runtime next time you run it.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.1",
  "pubDate": "2026-09-11T16:17:49.253Z",
  "pubdate": "2026-09-11T16:17:49.253Z",
  "executiveSummary": "A critical path traversal vulnerability exists within the projen project synthesis engine, specifically affecting the generated file manifest cleanup component. This flaw allows a context-dependent attacker to orchestrate the recursive deletion of files and directories located outside the intended project root directory.\nThe vulnerability resides in the insufficient validation of file paths within the version-controlled generated file manifest. By crafting malicious entries within this manifest, an attacker can bypass intended directory constraints, provided the process execution environment has the necessary filesystem permissions to modify or delete those target resources.\nSuccessful exploitation results in arbitrary file system deletion, which can lead to significant data loss, service disruption, or potentially facilitate further attacks by destroying configuration files or security-critical dependencies.\nThis vulnerability affects projen versions prior to 0.101.37. Organizations leveraging projen to manage project lifecycles are at risk if they synthesize projects containing untrusted or maliciously crafted manifest files. The primary remediation strategy requires upgrading the projen dependency to version 0.101.37 or later, which incorporates robust path validation logic to prevent unauthorized filesystem access.\nNo specific authentication is required if the attacker can influence the project's source code or manifest configuration, making supply chain security a critical factor in mitigating this risk.",
  "technicalDetails": "The root cause of this vulnerability is an improper implementation of path containment checks during the cleanup phase of the projen synthesis process. Projen utilizes a generated file manifest to track files created during project generation. During subsequent synthesis cycles, the cleanup component attempts to reconcile the current state with the manifest, invoking removal routines for files deemed obsolete or no longer managed by projen.\nThe vulnerability manifests because the cleanup logic fails to adequately sanitize or validate path strings contained within the manifest. An attacker can inject relative path traversal sequences (e.g., ../../../) into these entries. When the cleanup component parses these malicious manifest entries, it improperly resolves the path, failing to enforce boundary constraints that should limit file operations to the designated project directory.\nThe attack flow follows a structured exploitation path: First, an attacker modifies the project manifest or influences the synthesis process to include entries with traversal characters. Second, upon the next execution of the projen synthesis engine, the runtime reads the malicious manifest. Third, the cleanup component processes the entries, and due to the lack of a secure containment check, the system resolves the traversal sequences to absolute paths outside the project root.\nThe privilege requirement for this exploitation is aligned with the permissions of the user or system account running the projen process. Any filesystem object writable by the environment executing the synthesis process becomes a potential target for deletion. This is a post-exploitation impact scenario where the integrity of the host filesystem is compromised through the misuse of legitimate management functions.\nThe vulnerable component is identified as the manifest cleanup mechanism within the projen runtime. Previous versions (pre-0.101.37) lacked the necessary logic to verify that the target of a cleanup operation resides within the project root. This effectively turns a standard maintenance operation into a recursive file destruction primitive. Because projen is often run in automated CI/CD pipelines or developer environments, this vulnerability can lead to widespread impact on the integrity of project-local and system-level files depending on execution context.\nUpgrading to 0.101.37 introduces a corrected containment check that verifies if the resolved path is a subpath of the project directory before performing any deletion, effectively neutralizing the traversal capability."
}