Home

CVE-2019-16776

Description

Versions of the npm CLI prior to 6.13.3 are vulnerable to an Arbitrary File Write. It fails to prevent access to folders outside of the intended node_modules folder through the bin field. A properly constructed entry in the package.json bin field would allow a package publisher to modify and/or gain access to arbitrary files on a users system when the package is installed. This behavior is still possible through install scripts. This vulnerability bypasses a user using the --ignore-scripts install option.

Risk Information

Base Score
8.1
MODERATE
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
EPSS Score
Exploitation Probability
0.825

Associated Vulnerability

VulnerabilityOS Platform
Vulnerabilities CVE-2019-15845,CVE-2019-16776,CVE-2020-2581,CVE-2020-2595,CVE-2020-2604 are affected in Oracle GraalVM Enterprise Edition 19.3.0.2Windows
(RHSA-2020:0579)Important: security update nodejs-10.19.0-1.module+el8.1.0+5726+6ed65f8c.x86_64.rpmLinux
(RHSA-2020:0579)Important: security update nodejs-debuginfo-10.19.0-1.module+el8.1.0+5726+6ed65f8c.x86_64.rpmLinux
(RHSA-2020:0579)Important: security update nodejs-debugsource-10.19.0-1.module+el8.1.0+5726+6ed65f8c.x86_64.rpmLinux
(RHSA-2020:0579)Important: security update nodejs-devel-10.19.0-1.module+el8.1.0+5726+6ed65f8c.x86_64.rpmLinux
(RHSA-2020:0579)Important: security update nodejs-devel-debuginfo-10.19.0-1.module+el8.1.0+5726+6ed65f8c.x86_64.rpmLinux
(RHSA-2020:0579)Important: security update nodejs-docs-10.19.0-1.module+el8.1.0+5726+6ed65f8c.noarch.rpmLinux
(RHSA-2020:0579)Important: security update nodejs-nodemon-1.18.3-1.module+el8+2632+6c5111ed.noarch.rpmLinux
(RHSA-2020:0579)Important: security update nodejs-packaging-17-3.module+el8+2873+aa7dfd9a.noarch.rpmLinux
(RHSA-2020:0579)Important: security update npm-6.13.4-1.10.19.0.1.module+el8.1.0+5726+6ed65f8c.x86_64.rpmLinux

Patch Details

No records found

References

https://nvd.nist.gov/vuln/detail/CVE-2023-1234
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-1234