Critical severityNVD Advisory· Published Aug 25, 2025· Updated Apr 15, 2026

CVE-2025-9118

Description

A path traversal vulnerability in the NPM package installation process of Google Cloud Dataform allows a remote attacker to read and write files in other customers' repositories via a maliciously crafted package.json file.

Affected products

Google/Cloud Dataformllm-create

Patches

Vulnerability mechanics

References

cloud.devsite.corp.google.com/dataform/docs/security-bulletinsnvd

News mentions

No linked articles in our index yet.

cvss	0.585
epss	0.001
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000