Vulnetix
Try Vulnetix Request Demo
CVE-2019-16777 PUBLISHED

Versions of the npm CLI prior to 6.13.4 are vulnerable to an Arbitrary File Overwrite. It fails to prevent existing globally-installed binaries to be overwritten by other package installations. For example, if a package was installed globally and created a serve binary, any subsequent installs of packages that also create a serve binary would overwrite the previous serve binary. This behavior is still allowed in local installations and also through install scripts. This vulnerability bypasses a user using the --ignore-scripts install option.

EPSS 0.33% · 56.0th percentile

Risk Scores

EPSS Score
0.33%
56.0th percentile

Affected Products

VendorProductVersions
Ubuntu:14.04:LTSnpm0, 1.3.10~dfsg-1, 1.2.18~dfsg-3
Ubuntu:Pro:18.04:LTSnpm0, 3.5.2-0ubuntu4, 3.5.2-0ubuntu4.1.18.04.1~esm1
Ubuntu:Pro:16.04:LTSnpm3.5.2-0ubuntu4.1.16.04.1~esm1, 0, 1.4.21+ds-2
Ubuntu:20.04:LTSnpm0, 5.8.0+ds6-4, 6.14.4+ds-1ubuntu2
Ubuntu:22.04:LTSnpm0, 7.5.2+ds-2, 7.24.2+ds-1
Ubuntu:24.04:LTSnpm0, 9.2.0~ds1-1, 9.2.0~ds1-2
Ubuntu:25.10npm0, 9.2.0~ds1-3

Timeline

References

Open in Interactive Console →