Home

CVE-2019-16775

Description

Versions of the npm CLI prior to 6.13.3 are vulnerable to an Arbitrary File Write. It is possible for packages to create symlinks to files outside of thenode_modules folder through the bin field upon installation. A properly constructed entry in the package.json bin field would allow a package publisher to create a symlink pointing to arbitrary files on a users system when the package is installed. This behavior is still possible through install scripts. This vulnerability bypasses a user using the --ignore-scripts install option.

Risk Information

Base Score
6.5
MODERATE
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
EPSS Score
Exploitation Probability
0.721

Associated Vulnerability

VulnerabilityOS Platform
(RHSA-2020:0579)Important: security update nodejs-10.19.0-1.module+el8.1.0+5726+6ed65f8c.x86_64.rpmLinux
(RHSA-2020:0579)Important: security update nodejs-debuginfo-10.19.0-1.module+el8.1.0+5726+6ed65f8c.x86_64.rpmLinux
(RHSA-2020:0579)Important: security update nodejs-debugsource-10.19.0-1.module+el8.1.0+5726+6ed65f8c.x86_64.rpmLinux
(RHSA-2020:0579)Important: security update nodejs-devel-10.19.0-1.module+el8.1.0+5726+6ed65f8c.x86_64.rpmLinux
(RHSA-2020:0579)Important: security update nodejs-devel-debuginfo-10.19.0-1.module+el8.1.0+5726+6ed65f8c.x86_64.rpmLinux
(RHSA-2020:0579)Important: security update nodejs-docs-10.19.0-1.module+el8.1.0+5726+6ed65f8c.noarch.rpmLinux
(RHSA-2020:0579)Important: security update nodejs-nodemon-1.18.3-1.module+el8+2632+6c5111ed.noarch.rpmLinux
(RHSA-2020:0579)Important: security update nodejs-packaging-17-3.module+el8+2873+aa7dfd9a.noarch.rpmLinux
(RHSA-2020:0579)Important: security update npm-6.13.4-1.10.19.0.1.module+el8.1.0+5726+6ed65f8c.x86_64.rpmLinux

Patch Details

No records found

References

https://nvd.nist.gov/vuln/detail/CVE-2023-1234
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-1234