Path Traversal Vulnerability in Google Cloud Dataform NPM Package Installation

CVE-2025-9118

What is CVE-2025-9118?

A path traversal vulnerability exists within the NPM package installation process of Google Cloud Dataform. This issue enables remote attackers to exploit a maliciously crafted package.json file, potentially allowing unauthorized access to read or write files in other users' repositories. This vulnerability poses significant risks to data integrity and security, emphasizing the importance of secure coding practices and vigilant monitoring of package dependencies.

References