CVE-2026-89065
Received Received - Intake

Relative Path Traversal in projen File Manifest Cleanup

Publication date: 2026-09-11

Last updated on: 2026-09-11

Assigner: AMZN

Description
Relative path traversal in the generated file manifest cleanup component in projen before 0.101.37 might allow context-dependent attackers to recursively delete files and directories outside the project directory that are writable by the environment running projen, via crafted entries in the version-controlled generated file manifest that is consumed during project synthesis. To remediate this issue, users should upgrade to version 0.101.37. The corrected containment check is automatically applied by the projen runtime next time you run it.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-11
Last Modified
2026-09-11
Generated
2026-09-11
AI Q&A
2026-09-11
EPSS Evaluated
N/A
NVD
CVE-2026-89065
EUVD
EUVD-2026-76150

Affected Vendors & Products

Showing 3 associated CPEs
Vendor Product Version / Range
projen projen 0.101.37
projen projen to 0.101.37 (exc)
projen projen to 0.103.0 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-23 The product uses external input to construct a pathname that should be within a restricted directory, but it does not properly neutralize sequences such as ".." that can resolve to a location that is outside of that directory.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is a relative path traversal issue in the projen tool before version 0.101.37. It occurs in the generated file manifest cleanup component where crafted entries in .projen/files.json can cause the cleanup routine to resolve paths outside the project directory. This allows attackers to recursively delete files and directories writable by the environment running projen, leading to potential integrity and availability loss.

Detection Guidance

Check the .projen/files.json file in your project for entries containing ../ or absolute paths. Review version control history for suspicious modifications to this file. Ensure projen version is at least 0.101.37 to prevent exploitation.

Impact Analysis

This vulnerability could allow attackers to delete files and directories outside your project directory if they can manipulate the .projen/files.json file. This may result in loss of important data, disruption of services, or compromise of system integrity. The impact depends on the permissions of the environment running projen.

Mitigation Strategies

Upgrade projen to version 0.101.37 or later. If immediate upgrade is not possible, review .projen/files.json for ../ or absolute paths and remove them before running projen. No re-synthesis is required after upgrading.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-89065. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart