{"cve":"CVE-2018-7408","nvd":{"published":"2018-02-22T18:29:00.253","modified":"2026-06-17T02:03:05.407","status":"Modified","description":"An issue was discovered in an npm 5.7.0 2018-02-21 pre-release (marked as \"next: 5.7.0\" and therefore automatically installed by an \"npm upgrade -g npm\" command, and also announced in the vendor's blog without mention of pre-release status). It might allow local users to bypass intended filesystem access restrictions because ownerships of /etc and /usr directories are being changed unexpectedly, related to a \"correctMkdir\" issue.","cvss_v4":null,"cvss_v3":{"version":"3.0","vector":"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","score":7.8},"cwes":["CWE-732"],"references":["http://blog.npmjs.org/post/171169301000/v571","https://github.com/npm/npm/commit/74e149da6efe6ed89477faa81fef08eee7999ad0","https://github.com/npm/npm/issues/19883","http://blog.npmjs.org/post/171169301000/v571","https://github.com/npm/npm/commit/74e149da6efe6ed89477faa81fef08eee7999ad0"],"products":["npmjs:npm"],"source":"nvd","synced_at":"2026-10-19T20:48:34.567387330+00:00"},"epss":{"cve":"CVE-2018-7408","score":0.0032,"percentile":0.25068,"date":"2026-10-31"},"kev":null,"osv":[{"id":"GHSA-ph34-pc88-72gc","url":"https://osv.dev/vulnerability/GHSA-ph34-pc88-72gc","summary":"Incorrect Permission Assignment for Critical Resource in NPM","modified":"2026-09-10T03:49:35.487521550Z","packages":[{"ecosystem":"npm","name":"npm","purl":"pkg:npm/npm","ranges":["<5.7.1"],"fixed":["5.7.1"]}]}],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}