CVE-2026-44225

CRITICAL

Pulpy: Incomplete filesystem sandbox in pulpy.fs bridge allows packaged web apps to read arbitrary user files

Title source: CVE List
Search associated code STIX 2.1 vulnerability STIX 2.1 with PoCs

Record summary

CVE-2026-44225 has a selected CVSS score of 9.3 (critical); EIP currently links 1 catalogued exploit.

Description

Pulpy is a lightweight, cross-platform desktop application packager for web apps. Prior to 0.1.1, Pulpy injects a pulpy.fs JavaScript API into every packaged web application, giving it access to the host filesystem. A validateFsPath() function is supposed to sandbox this access, but its blocklist is incomplete. Any web app packaged with Pulpy can read and write arbitrary files in the user's home directory — including ~/.ssh/id_rsa, ~/.aws/credentials, and ~/Library/Keychains/. This vulnerability is fixed in 0.1.1.

Description source: CVE List

Exploitation context

Available material

Catalogued exploits
1

CISA SSVC decision

ExploitationPoC
AutomatableNo
Technical impactTotal

CISA Coordinator · SSVC 2.0.3 · Evaluated May 14, 2026 · Source: CVE List

Affected products and versions

1
ProductSourceVersion range

Pulpy

Browse enesgkky / Pulpy
CVE List< 0.1.1affected

Proofs of concept

1

Catalogued exploits

ExploitDBPulpy 0.1.1-Beta - Filesystem Sandbox BypassExploitDB exploitby Onur BILICIExploit1 file
ExploitDB
PoC details
Analysisdeepseek-v4-pro:cloud ·

Technical assessment

The artifact provides JavaScript code that uses the pulpy.fs.readFile API to read a user's SSH private key from a path that bypasses the incomplete sandbox blocklist, constituting an exploit.

Backdoor review

No backdoor observed in reviewed code

The supplied text is a standard public proof-of-concept (PoC) exploit for CVE-2026-44225. It describes a filesystem sandbox bypass in Pulpy 0.1.1-Beta and provides JavaScript code that demonstrates reading a sensitive file using the vulnerable pulpy.fs API. The code performs the advertised exploit behavior (reading a file outside the intended sandbox) and includes a commented-out suggestion for exfiltration, which is a typical part of demonstrating impact in a PoC. No concealed backdoor, unrelated payload, or deceptive behavior targeting the person reviewing the PoC was observed.

ClassificationExploit
Model confidence95%
AuthenticationNot required
Languagesjavascript
Target softwarePulpy
Attack typespath traversalsandbox bypass
Evidence & reasoningClassification basis · observed behavior · safety review
Technical evidence

Classification basis and observed behavior

Classification basis

The artifact contains executable JavaScript code that actively reads a sensitive file (SSH private key) from a path that bypasses the sandbox, which is the definition of an exploit. The code is not merely a detection script; it performs the unauthorized access.

exploits/multiple/webapps/52616.txt:43-61

Requirements

  • Target must be running a web application packaged with a vulnerable version of Pulpy (<= 0.1.1-Beta).exploits/multiple/webapps/52616.txt:7
  • Attacker must know or be able to resolve the target user's username to construct the path.exploits/multiple/webapps/52616.txt:47-48

Observed behavior

  • Executes pulpy.fs.readFile on a path like /Users/<username>/.ssh/id_rsa to read the file contents, bypassing the sandbox because the blocklist only checks for root-level paths.exploits/multiple/webapps/52616.txt:48-55
  • Logs the file content to the console and includes a comment suggesting exfiltration to an attacker-controlled server.exploits/multiple/webapps/52616.txt:55-57
Safety-review evidence

Behaviors behind the backdoor verdict

Observables

Commented Exfiltration Suggestion
Payload withheldThe PoC includes a commented-out line suggesting how an attacker might exfiltrate data. This is a standard demonstration of impact in a PoC and is not executed by the PoC itself. It does not constitute a backdoor or deceptive payload targeting the reviewer.exploits/multiple/webapps/52616.txt:57
Review boundaries

What the analysis did not establish

  • The exploit code requires the attacker to know or dynamically resolve the target's username, which is not provided in the artifact.
  • The exfiltration logic is only a comment and not implemented as functional code.
  • The artifact is a single text file; no external dependencies or execution environment are included.
  • Only the text content of the supplied file was reviewed; no external resources, links, or binary files were fetched or analyzed.
  • The review does not assess whether the PoC code functions as described or is safe to execute against a vulnerable target.
Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.

References

1