DEBIAN-CVE-2017-18869

DEBIAN-CVE-2017-18869 PUBLISHED CVSS 2.5 LOW

A TOCTOU issue in the chownr package before 1.1.0 for Node.js 10.10 could allow a local attacker to trick it into descending into unintended directories via symlink attacks.

Risk Scores

CVSS v3.1

2.5

CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N

Affected Products

Vendor	Product	Versions
Debian:11	node-chownr	0, 0, 0
Debian:14	node-chownr	0, 0, 0
Debian:13	node-chownr	0, 0, 0
Debian:12	node-chownr	0, 0, 0

Timeline

Jun 15, 2020 CVE Published
Apr 28, 2026 CVE Updated

References

https://security-tracker.debian.org/tracker/CVE-2017-18869 advisory

Open in Interactive Console →