Vulnetix
Try Vulnetix Request Demo
CVE-2019-16775 PUBLISHED

Versions of the npm CLI prior to 6.13.3 are vulnerable to an Arbitrary File Write. It is possible for packages to create symlinks to files outside of thenode_modules folder through the bin field upon installation. A properly constructed entry in the package.json bin field would allow a package publisher to create a symlink pointing to arbitrary files on a user's system when the package is installed. This behavior is still possible through install scripts. This vulnerability bypasses a user using the --ignore-scripts install option.

EPSS 0.68% · 71.5th percentile

Risk Scores

EPSS Score
0.68%
71.5th percentile

Affected Products

VendorProductVersions
Ubuntu:14.04:LTSnpm1.3.10~dfsg-1, 1.2.18~dfsg-3, 0
Ubuntu:Pro:16.04:LTSnpm3.5.2-0ubuntu4.1.16.04.1~esm1, 0, 1.4.21+ds-2
Ubuntu:Pro:18.04:LTSnpm0, 3.5.2-0ubuntu4, 3.5.2-0ubuntu4.1.18.04.1~esm1
Ubuntu:24.04:LTSnpm9.2.0~ds1-1, 9.2.0~ds1-2, 0
Ubuntu:20.04:LTSnpm0, 5.8.0+ds6-4, 6.14.4+ds-1ubuntu2
Ubuntu:22.04:LTSnpm0, 7.5.2+ds-2, 7.24.2+ds-1
Ubuntu:25.10npm0, 9.2.0~ds1-3

Timeline

References

Open in Interactive Console →