CVSS 3.1
6.5 mediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:NCVE-2019-16775
Versions of the npm CLI prior to 6.13.3 are vulnerable to an Arbitrary File Write. It is possible for packages to create symlinks to files outside of thenode_modules folder through the bin field upon installation. A properly constructed entry in the package.json bin field would allow a package publisher to create a symlink pointing to arbitrary files on a user's system when the package is installed. This behavior is still possible through install scripts. This vulnerability bypasses a user using the --ignore-scripts install option.
Severity
- EPSS
- 3.3% chance of exploitation in the next 30 days; higher than 88% of CVEs (scores of 2026-10-31)
- CWEs
- CWE-59, CWE-61
- Published
- Modified
- Record from
- the NVD, synced
Affected
- fedoraproject:fedora
- npmjs:npm
- opensuse:leap
- oracle:graalvm
- redhat:enterprise_linux
- redhat:enterprise_linux_eus
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-m6cx-g6qm-p2cx | npm | npm | <6.13.3 | 6.13.3 |