Versions of the npm CLI prior to 6.13.3 are vulnerable to an Arbitrary File Write. It fails to prevent access to folders outside of the intended node_modules folder through the bin field. A properly constructed entry in the package.json bin field would allow a package publisher to modify and/or gain access to arbitrary files on a user's system when the package is installed. This behavior is still possible through install scripts. This vulnerability bypasses a user using the --ignore-scripts install option.
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade nodejs-nodemonUpgrade nodejs-packaging | May 4, 2022 | Dec 13, 2019 |
| Centos_linux | — | Upgrade nodejsUpgrade nodejs-develUpgrade nodejs-docsUpgrade nodejs-debugsourceUpgrade nodejs-packagingUpgrade nodejs-debuginfoUpgrade nodejs-devel-debuginfoUpgrade nodejs-nodemonUpgrade npm | Feb 26, 2020 | Dec 13, 2019 |
| Debian | — | Upgrade npm | Jul 30, 2024 | Dec 13, 2019 |
| F5 Big Ip | — | Update F5 BIG-IP to the latest version | Jul 3, 2026 | Jul 2, 2026 |
| Freebsd | — | Upgrade npm | Jun 11, 2020 | Jun 10, 2020 |
| Oracle Solaris | — | Upgrade runtime/nodejs/nodejs-8 to version 8.17.0-11.4.18.0.1.2.0 on Solaris 11.4Upgrade runtime/nodejs/nodejs-10 to version 10.19.0-11.4.21.0.1.69.0 on Solaris 11.4Upgrade runtime/nodejs to version 8.17.0-11.4.18.0.1.2.0 on Solaris 11.4 | Jan 19, 2021 | Dec 13, 2019 |
| Oracle_linux | — | Upgrade nodejs-packagingUpgrade npmUpgrade nodejs-nodemonUpgrade nodejsUpgrade nodejs-docsUpgrade nodejs-devel | Mar 2, 2020 | Dec 12, 2019 |
| Redhat_linux | — | Upgrade nodejs-packagingUpgrade nodejs-devel-debuginfoUpgrade nodejs-docsUpgrade nodejs-develUpgrade nodejsUpgrade nodejs-debugsourceUpgrade npmUpgrade nodejs-nodemonUpgrade nodejs-debuginfo | Feb 26, 2020 | Dec 13, 2019 |
| Rocky_linux | — | — | Aug 15, 2024 | Dec 13, 2019 |
| Suse | — | Upgrade nodejs8-docsUpgrade nodejs12Upgrade nodejs10Upgrade npm8Upgrade nodejs8Upgrade npm12Upgrade nodejs6Upgrade nodejs6-docsUpgrade nodejs8-develUpgrade nodejs12-develUpgrade nodejs6-develUpgrade nodejs10-docsUpgrade npm6Upgrade npm10Upgrade nodejs12-docsUpgrade nodejs10-devel | Jan 15, 2020 | Dec 13, 2019 |
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub