Versions of the npm CLI prior to 6.13.3 are vulnerable to an Arbitrary File Write. It is possible for packages to create symlinks to files outside of thenode_modules folder through the bin field upon installation. A properly constructed entry in the package.json bin field would allow a package publisher to create a symlink pointing to arbitrary files on a user's system when the package is installed. This behavior is still possible through install scripts. This vulnerability bypasses a user using the --ignore-scripts install option.
CVSS Details
- CVSS 3.1 Base Score: 7.7
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade nodejs-packagingUpgrade nodejs-nodemon | May 4, 2022 | Dec 13, 2019 |
| Centos_linux | — | Upgrade nodejs-devel-debuginfoUpgrade nodejsUpgrade nodejs-packagingUpgrade nodejs-debugsourceUpgrade nodejs-docsUpgrade nodejs-debuginfoUpgrade npmUpgrade nodejs-nodemonUpgrade nodejs-devel | Feb 26, 2020 | Dec 13, 2019 |
| Debian | — | Upgrade npm | Jul 30, 2024 | Dec 13, 2019 |
| F5 Big Ip | — | Update F5 BIG-IP to the latest version | Jul 3, 2026 | Jul 2, 2026 |
| Freebsd | — | Upgrade npm | Jun 11, 2020 | Jun 10, 2020 |
| Oracle Solaris | — | Upgrade runtime/nodejs/nodejs-10 to version 10.19.0-11.4.21.0.1.69.0 on Solaris 11.4Upgrade runtime/nodejs to version 8.17.0-11.4.18.0.1.2.0 on Solaris 11.4Upgrade runtime/nodejs/nodejs-8 to version 8.17.0-11.4.18.0.1.2.0 on Solaris 11.4 | Jan 19, 2021 | Dec 13, 2019 |
| Oracle_linux | — | Upgrade nodejs-docsUpgrade nodejs-develUpgrade nodejs-packagingUpgrade nodejsUpgrade npmUpgrade nodejs-nodemon | Mar 2, 2020 | Dec 12, 2019 |
| Redhat_linux | — | Upgrade nodejs-develUpgrade nodejs-docsUpgrade nodejs-nodemonUpgrade nodejs-devel-debuginfoUpgrade nodejs-debuginfoUpgrade nodejsUpgrade nodejs-debugsourceUpgrade nodejs-packagingUpgrade npm | Feb 26, 2020 | Dec 13, 2019 |
| Rocky_linux | — | — | Aug 15, 2024 | Dec 13, 2019 |
| Suse | — | Upgrade nodejs10-develUpgrade npm6Upgrade npm10Upgrade nodejs6-develUpgrade nodejs6Upgrade nodejs10-docsUpgrade npm8Upgrade nodejs12-docsUpgrade nodejs8-develUpgrade nodejs12-develUpgrade nodejs8-docsUpgrade npm12Upgrade nodejs6-docsUpgrade nodejs10Upgrade nodejs12Upgrade nodejs8 | Jan 15, 2020 | Dec 13, 2019 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub