Relative Path Traversal Vulnerability in Projen by Axo

CVE-2026-89065

What is CVE-2026-89065?

A vulnerability in the file manifest cleanup component of Projen allows context-specific attackers to exploit relative path traversal. This flaw can permit malicious actors to recursively delete files and directories outside the designated project directory, provided these files are writable by the environment running Projen. Attackers can leverage carefully crafted entries in the version-controlled generated file manifest, which are processed during project synthesis. To protect against this vulnerability, it is crucial for users to upgrade to version 0.101.37, where the projen runtime will automatically apply the necessary containment checks on the next execution.

References