CVE-2019-16775 — UNIX Symbolic Link (Symlink) Following in CLI

CWE-61 — UNIX Symbolic Link (Symlink) FollowingCWE-59 — Link FollowingCWE-20 — Improper Input Validation10 documents7 sources
Severity
6.5MEDIUMNVD
CNA7.7
EPSS
0.7%
top 28.31%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
7
NPM CLINpmjs NPMFedoraproject Fedora+4 more
Timeline
PublishedDec 13
Latest updateJan 6

Description

Versions of the npm CLI prior to 6.13.3 are vulnerable to an Arbitrary File Write. It is possible for packages to create symlinks to files outside of thenode_modules folder through the bin field upon installation. A properly constructed entry in the package.json bin field would allow a package publisher to create a symlink pointing to arbitrary files on a user's system when the package is installed. This behavior is still possible through install scripts. This vulnerability bypasses a user using…

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:NExploitability: 2.8 | Impact: 3.6

Affected Packages6 packages

▶CVEListV5npm/cli< 6.13.3
▶NVDnpmjs/npm< 6.13.3
▶npmnpmjs/npm< 6.13.3
▶Debiannpmjs/npm< 6.13.4+ds-2+3
▶NVDopensuse/leap15.1

Also affects: Fedora 31, Enterprise Linux 8.0, 8.1

🔴Vulnerability Details

4
OSV
CVE-2019-16775: Versions of the npm CLI prior to 6↗2019-12-13
▶
CVEList
Unauthorized File Access in npm CLI before before version 6.13.3↗2019-12-13
▶
OSV
Arbitrary File Write in npm↗2019-12-13
▶
GHSA
Arbitrary File Write in npm↗2019-12-13
▶

📋Vendor Advisories

2
Red Hat
npm: Symlink reference outside of node_modules folder through the bin field upon installation↗2019-12-12
▶
Debian
CVE-2019-16775: npm - Versions of the npm CLI prior to 6.13.3 are vulnerable to an Arbitrary File Writ...↗2019
▶

💬Community

3
Bugzilla
CVE-2019-16775 nodejs: Symlink reference outside of node_modules folder through the bin field upon installation [fedora-all]↗2020-01-06
▶
Bugzilla
CVE-2019-16775 nodejs: npm: Symlink reference outside of node_modules folder through the bin field upon installation [epel-all]↗2020-01-06
▶
Bugzilla
CVE-2019-16775 npm: Symlink reference outside of node_modules folder through the bin field upon installation↗2020-01-06
▶
CVE-2019-16775 — UNIX Symbolic Link (Symlink) Following | cvebase