Unauthorized File Access in npm CLI before before version 6.13.3 (npm cli)

CVE-2019-16775

HIGH 7.7

En bref

Source: NVD
EPSS: EPSS 3.33 % · centile 89 (2026-10-31)
État: PUBLISHED
Publiée: 2019-12-13 00:55 UTC
Mise à jour: 2024-08-05 01:24 UTC
Attribuée par: GitHub_M
Statut NVD: Modified

Rechercher sur…

Description

Versions of the npm CLI prior to 6.13.3 are vulnerable to an Arbitrary File Write. It is possible for packages to create symlinks to files outside of thenode_modules folder through the bin field upon installation. A properly constructed entry in the package.json bin field would allow a package publisher to create a symlink pointing to arbitrary files on a user's system when the package is installed. This behavior is still possible through install scripts. This vulnerability bypasses a user using the --ignore-scripts install option.

Faiblesses (CWE)

CWE-61 — UNIX Symbolic Link (Symlink) Following
CWE-59 — Suivi de lien non maîtrisé

Références

Scores

Version	Score	Vecteur	Évalué par
CVSS 3.1	HIGH 7.7	CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:N	GitHub_M
CVSS 3.1	HIGH 7.7	CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:N	NVD · security-advisories@github.com (Secondary)
CVSS 3.1	MEDIUM 6.5	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N	NVD · nvd@nist.gov (Primary)
CVSS 2.0	MEDIUM 4.0	AV:N/AC:L/Au:S/C:N/I:P/A:N	NVD · nvd@nist.gov (Primary)

Avis

GHSA-m6cx-g6qm-p2cx — Arbitrary File Write in npm

Références européennes

ENISA EUVD · EUVD-2019-0798
GCVE · GCVE-0-2019-16775

Avis du CERT-FR

CERTFR-2025-AVI-0969 — Multiples vulnérabilités dans les produits VMware · cert.ssi.gouv.fr
CERTFR-2024-AVI-0575 — Multiples vulnérabilités dans les produits Juniper Networks · cert.ssi.gouv.fr

Configurations affectées (CPE NVD)

cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_eus:8.1:*:*:*:*:*:*:*
cpe:2.3:a:npmjs:npm:*:*:*:*:*:*:*:* < 6.13.3
cpe:2.3:o:opensuse:leap:15.1:*:*:*:*:*:*:*
cpe:2.3:a:oracle:graalvm:19.3.0.2:*:*:*:enterprise:*:*:*
cpe:2.3:a:oracle:graalvm:20.3.3:*:*:*:enterprise:*:*:*
cpe:2.3:a:oracle:graalvm:21.2.2:*:*:*:enterprise:*:*:*
cpe:2.3:o:fedoraproject:fedora:31:*:*:*:*:*:*:*

Produits affectés

Produit	Versions
npm · cli	affected < 6.13.3 < 6.13.3

Sources

Source	Licence
CVE List (CVEProject cvelistV5)	CVE Program Terms of Use
EPSS (FIRST.org)	FIRST — attribution requested
ENISA EUVD	ENISA — reproduction authorised, source acknowledged
CERT-FR (ANSSI)	Licence Ouverte / Etalab 2.0
NVD (NIST) via fkie-cad/nvd-json-data-feeds	Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD

⚠️ Unauthorized File Access in npm CLI before before version 6.13.3 (npm cli)