Versions of the npm CLI prior to 6.13.4 are vulnerable to an Arbitrary File Overwrite. It fails to prevent existing globally-installed binaries to be overwritten by other package installations. For example, if a package was installed globally and created a serve binary, any subsequent installs of packages that also create a serve binary would overwrite the previous serve binary. This behavior is still allowed in local installations and also through install scripts. This vulnerability bypasses a user using the --ignore-scripts install option.
CVSS Details
- CVSS 3.1 Base Score: 7.7
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | alma-upgrade-nodejs-nodemonalma-upgrade-nodejs-packaging | May 4, 2022 | Dec 13, 2019 | |
| Centos_linux | — | centos-upgrade-nodejscentos-upgrade-nodejs-debuginfocentos-upgrade-nodejs-debugsourcecentos-upgrade-nodejs-develcentos-upgrade-nodejs-devel-debuginfocentos-upgrade-nodejs-docscentos-upgrade-nodejs-nodemoncentos-upgrade-nodejs-packagingcentos-upgrade-npm | Feb 26, 2020 | Dec 13, 2019 |
| Debian | debian-upgrade-npm | Jul 30, 2024 | Dec 13, 2019 | |
| F5 Big Ip | f5-bigip-upgrade-latest | Jul 3, 2026 | Jul 2, 2026 | |
| Freebsd | freebsd-upgrade-package-npm | Jun 11, 2020 | Jun 10, 2020 | |
| Gentoo Linux | gentoo-linux-upgrade-net-libs-nodejs | Mar 23, 2020 | Dec 13, 2019 | |
| Oracle Solaris | oracle-solaris-11-4-upgrade-runtime-nodejs-8-17-0-11-4-18-0-1-2-0oracle-solaris-11-4-upgrade-runtime-nodejs-nodejs-10-10-19-0-11-4-21-0-1-69-0oracle-solaris-11-4-upgrade-runtime-nodejs-nodejs-8-8-17-0-11-4-18-0-1-2-0 | Jan 19, 2021 | Dec 13, 2019 | |
| Oracle_linux | — | oracle-linux-upgrade-nodejsoracle-linux-upgrade-nodejs-develoracle-linux-upgrade-nodejs-docsoracle-linux-upgrade-nodejs-nodemonoracle-linux-upgrade-nodejs-packagingoracle-linux-upgrade-npm | Mar 2, 2020 | Dec 12, 2019 |
| Redhat_linux | redhat-upgrade-nodejsredhat-upgrade-nodejs-debuginforedhat-upgrade-nodejs-debugsourceredhat-upgrade-nodejs-develredhat-upgrade-nodejs-devel-debuginforedhat-upgrade-nodejs-docsredhat-upgrade-nodejs-nodemonredhat-upgrade-nodejs-packagingredhat-upgrade-npm | Feb 26, 2020 | Dec 13, 2019 | |
| Suse | — | suse-upgrade-nodejs10suse-upgrade-nodejs10-develsuse-upgrade-nodejs10-docssuse-upgrade-nodejs12suse-upgrade-nodejs12-develsuse-upgrade-nodejs12-docssuse-upgrade-nodejs6suse-upgrade-nodejs6-develsuse-upgrade-nodejs6-docssuse-upgrade-nodejs8suse-upgrade-nodejs8-develsuse-upgrade-nodejs8-docssuse-upgrade-npm10suse-upgrade-npm12suse-upgrade-npm6suse-upgrade-npm8 | Jan 16, 2020 | Dec 13, 2019 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub