CVE-2019-16775highCWE-61

CVE-2019-16775: high-severity vulnerability in npm cli

Unauthorized File Access in npm CLI before before version 6.13.3

Published · Updated

21Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 7.7epss 3.3%
exploitation probability
3.3%top 12% of all CVEs
observed exploitation
nono source reports it
In short

npm versions before 6.13.3 allow malicious packages to create symbolic links to arbitrary files on your system during installation, potentially overwriting or exposing sensitive data even if you disable scripts.

Technical detail

The npm CLI fails to validate symlink destinations in the bin field during package installation, allowing an attacker to create symlinks pointing outside node_modules to arbitrary filesystem locations. This occurs regardless of the --ignore-scripts flag, enabling unauthorized file access or modification with the privileges of the installing user.

Summary generated and translated by AI from the official description.
Versions of the npm CLI prior to 6.13.3 are vulnerable to an Arbitrary File Write. It is possible for packages to create symlinks to files outside of thenode_modules folder through the bin field upon installation. A properly constructed entry in the package.json bin field would allow a package publisher to create a symlink pointing to arbitrary files on a user's system when the package is installed. This behavior is still possible through install scripts. This vulnerability bypasses a user using the --ignore-scripts install option.
CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:N
Affected products
npm · cli
Related CVEs — npm cli

In the same product, most dangerous first.

CVE-2019-16776HIGHUnauthorized File Access in npm CLI before before version 6.13.3EPSS 3.4%CVE-2019-16777HIGHArbitrary File Overwrite in npm CLIEPSS 2.1%CVE-2020-15095MEDIUMSensitive information exposure through logs in npm cliEPSS 0.4%CVE-2026-0775HIGHnpm cli Incorrect Permission Assignment Local Privilege Escalation VulnerabilityEPSS 0.3%
References
http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00027.htmlhttps://access.redhat.com/errata/RHEA-2020:0330https://access.redhat.com/errata/RHSA-2020:0573https://access.redhat.com/errata/RHSA-2020:0579https://access.redhat.com/errata/RHSA-2020:0597https://access.redhat.com/errata/RHSA-2020:0602https://blog.npmjs.org/post/189618601100/binary-planting-with-the-npm-clihttps://github.com/npm/cli/security/advisories/GHSA-m6cx-g6qm-p2cxhttps://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/Z36UKPO5F3PQ3Q2POMF5LEKXWAH5RUFP/https://www.oracle.com/security-alerts/cpujan2020.htmlhttps://www.oracle.com/security-alerts/cpuoct2021.html