Vulnetix
Try Vulnetix Request Demo
CVE-2019-16776 PUBLISHED

Versions of the npm CLI prior to 6.13.3 are vulnerable to an Arbitrary File Write. It fails to prevent access to folders outside of the intended node_modules folder through the bin field. A properly constructed entry in the package.json bin field would allow a package publisher to modify and/or gain access to arbitrary files on a user's system when the package is installed. This behavior is still possible through install scripts. This vulnerability bypasses a user using the --ignore-scripts install option.

EPSS 0.78% · 73.6th percentile

Risk Scores

EPSS Score
0.78%
73.6th percentile

Affected Products

VendorProductVersions
Ubuntu:22.04:LTSnpm8.5.1~ds-1, 7.24.2+ds-1, 7.24.2+ds-2
Ubuntu:20.04:LTSnpm0, 5.8.0+ds6-4, 6.14.4+ds-1ubuntu2
Ubuntu:24.04:LTSnpm9.2.0~ds1-1, 9.2.0~ds1-2, 0
Ubuntu:Pro:18.04:LTSnpm0, 3.5.2-0ubuntu4, 3.5.2-0ubuntu4.1.18.04.1~esm1
Ubuntu:25.10npm0, 9.2.0~ds1-3
Ubuntu:Pro:16.04:LTSnpm3.5.2-0ubuntu4.1.16.04.1~esm1, 0, 1.4.21+ds-2
Ubuntu:14.04:LTSnpm1.2.18~dfsg-3, 1.3.10~dfsg-1, 0

Timeline

References

Open in Interactive Console →