Arbitrary File Overwrite in npm CLI (npm cli)

CVE-2019-16777

HIGH 7.7

En bref

Source: NVD
EPSS: EPSS 2.13 % · centile 82 (2026-10-31)
État: PUBLISHED
Publiée: 2019-12-13 01:00 UTC
Mise à jour: 2024-08-05 01:24 UTC
Attribuée par: GitHub_M
Statut NVD: Modified

Rechercher sur…

Description

Versions of the npm CLI prior to 6.13.4 are vulnerable to an Arbitrary File Overwrite. It fails to prevent existing globally-installed binaries to be overwritten by other package installations. For example, if a package was installed globally and created a serve binary, any subsequent installs of packages that also create a serve binary would overwrite the previous serve binary. This behavior is still allowed in local installations and also through install scripts. This vulnerability bypasses a user using the --ignore-scripts install option.

Faiblesses (CWE)

CWE-22 — Traversée de répertoire
CWE-269 — Gestion incorrecte des privilèges

Références

Scores

Version	Score	Vecteur	Évalué par
CVSS 3.1	HIGH 7.7	CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:N	GitHub_M
CVSS 3.1	HIGH 7.7	CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:N	NVD · security-advisories@github.com (Secondary)
CVSS 3.1	MEDIUM 6.5	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N	NVD · nvd@nist.gov (Primary)
CVSS 2.0	MEDIUM 5.5	AV:N/AC:L/Au:S/C:N/I:P/A:P	NVD · nvd@nist.gov (Primary)

Avis

GHSA-4328-8hgf-7wjr — npm Vulnerable to Global node_modules Binary Overwrite

Références européennes

ENISA EUVD · EUVD-2019-0774
GCVE · GCVE-0-2019-16777

Avis du CERT-FR

CERTFR-2025-AVI-0969 — Multiples vulnérabilités dans les produits VMware · cert.ssi.gouv.fr
CERTFR-2024-AVI-0575 — Multiples vulnérabilités dans les produits Juniper Networks · cert.ssi.gouv.fr

Configurations affectées (CPE NVD)

cpe:2.3:a:npmjs:npm:*:*:*:*:*:*:*:* < 6.13.4
cpe:2.3:o:opensuse:leap:15.1:*:*:*:*:*:*:*
cpe:2.3:a:oracle:graalvm:19.3.0.2:*:*:*:enterprise:*:*:*
cpe:2.3:o:fedoraproject:fedora:31:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_eus:8.1:*:*:*:*:*:*:*

Produits affectés

Produit	Versions
npm · cli	affected < 6.13.4 < 6.13.4

Sources

Source	Licence
CVE List (CVEProject cvelistV5)	CVE Program Terms of Use
EPSS (FIRST.org)	FIRST — attribution requested
ENISA EUVD	ENISA — reproduction authorised, source acknowledged
CERT-FR (ANSSI)	Licence Ouverte / Etalab 2.0
NVD (NIST) via fkie-cad/nvd-json-data-feeds	Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD

⚠️ Arbitrary File Overwrite in npm CLI (npm cli)