How do I check whether I am affected by CVE-2026-89065?

- Run `npx projen --version` or check `package.json` for the `projen` version; affected if below `0.101.37`. - Review git history of `.projen/files.json` for entries whose paths escape the project directory (such as `../`).

What is the fix for CVE-2026-89065?

- Upgrade projen to `0.101.37` or later; re-synthesis is not required for this issue. - Remove any escaping entries from `.projen/files.json` before running projen.

Who is not affected by CVE-2026-89065?

Not affected if: not-using-projen, version-0.101.37-or-later.

Live › vulnerability › CVE-2026-89065

Go to dashboard

high7.1Package

projen: crafted manifest entries let project sync delete files outside the repo

projen, a tool that generates project configuration, has a path traversal flaw in its cleanup of generated files. A crafted entry in the committed .projen/files.json can make a synthesis run recursively delete files and directories outside the project directory.

Summary written from the sources below. Check the originals before acting.

CVSS 4.0

7.1

high

scored by ff89ba41-3aa1-4d27-914a-91399e9639e5

known so far5 of 6

missing: versions

First public: Sep 11, 2026 UTC
Last modified: Sep 11, 2026
Status: open
Known exploitation: None reported
Public exploit: None on GitHub
EPSS: 0.2% in 30d

First seen by InfraStack 2026-10-24 19:12 UTC, 0h before NVD. All times on this page are UTC.

Why it is high, and not just CVSS

Likelihood → · Impact ↓

critical

high

medium

high

medium

low

medium

low

Exploited: No reports yet.
Needs login: Not known from the sources.
Needs a special setup: No.
Reachable from: local.
Worst case: Files and directories outside the project directory get recursively deleted.
CVSS said: 7.1. The facts above say medium; we keep the sources' high until an analyst looks.

Who is affected

Teams that use projen to generate and synthesize their project configuration, and whose repositories contain a that could be altered by a contributor or an untrusted change. Projen users on or later are not affected by this flaw. Teams not using projen can skip it.

Know the next one before it finds you.

Add to Slack

Live › vulnerability › CVE-2026-89065

Go to dashboard

high7.1Package

projen: crafted manifest entries let project sync delete files outside the repo

Summary written from the sources below. Check the originals before acting.

CVSS 4.0

7.1

high

scored by ff89ba41-3aa1-4d27-914a-91399e9639e5

known so far5 of 6

missing: versions

First public: Sep 11, 2026 UTC
Last modified: Sep 11, 2026
Status: open
Known exploitation: None reported
Public exploit: None on GitHub
EPSS: 0.2% in 30d

First seen by InfraStack 2026-10-24 19:12 UTC, 0h before NVD. All times on this page are UTC.

Why it is high, and not just CVSS

Likelihood → · Impact ↓

critical

high

medium

high

medium

low

medium

low

Exploited: No reports yet.
Needs login: Not known from the sources.
Needs a special setup: No.
Reachable from: local.
Worst case: Files and directories outside the project directory get recursively deleted.
CVSS said: 7.1. The facts above say medium; we keep the sources' high until an analyst looks.

Who is affected

Know the next one before it finds you.

Add to Slack

projen: crafted manifest entries let project sync delete files outside the repo

Why it is high, and not just CVSS

Who is affected

Know the next one before it finds you.

projen: crafted manifest entries let project sync delete files outside the repo

Why it is high, and not just CVSS

Who is affected

Know the next one before it finds you.

How to check

The fix

Who had it, and when

What the sources say, verbatim

CVE-2026-89065 and CVE-2026-89066: Issue with projen - Path traversal and OS command injection

Sources