CVE-2017-18869 PUBLISHED

A TOCTOU issue in the chownr package before 1.1.0 for Node.js 10.10 could allow a local attacker to trick it into descending into unintended directories via symlink attacks.

EPSS 0.12% · 30.1th percentile

Risk Scores

EPSS Score
0.12%
30.1th percentile

Affected Products

VendorProductVersions
Ubuntu:22.04:LTSnode-chownr0, 2.0.0-1, 1.1.3-5
Ubuntu:25.10node-chownr2.0.0-3, 0
Ubuntu:20.04:LTSnode-chownr1.1.1-1, 0, 1.1.3-3
Ubuntu:24.04:LTSnode-chownr0, 2.0.0-2

Timeline

References

Open in Interactive Console →