CVE-2019-16776 — Path Traversal in CLI

CWE-22 — Path TraversalCWE-20 — Improper Input Validation11 documents8 sources
Severity
8.1HIGHNVD
CNA7.7
EPSS
0.8%
top 26.22%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
7
NPM CLINpmjs NPMFedoraproject Fedora+4 more
Timeline
PublishedDec 13
Latest updateJan 15

Description

Versions of the npm CLI prior to 6.13.3 are vulnerable to an Arbitrary File Write. It fails to prevent access to folders outside of the intended node_modules folder through the bin field. A properly constructed entry in the package.json bin field would allow a package publisher to modify and/or gain access to arbitrary files on a user's system when the package is installed. This behavior is still possible through install scripts. This vulnerability bypasses a user using the --ignore-scripts inst…

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:NExploitability: 2.8 | Impact: 5.2

Affected Packages6 packages

▶CVEListV5npm/cli< 6.13.3
▶NVDnpmjs/npm< 6.13.3
▶npmnpmjs/npm< 6.13.3
▶Debiannpmjs/npm< 6.13.4+ds-2+3
▶NVDopensuse/leap15.1

Also affects: Fedora 31, Enterprise Linux 8.0, 8.1

🔴Vulnerability Details

4
GHSA
npm symlink reference outside of node_modules↗2019-12-13
▶
CVEList
Unauthorized File Access in npm CLI before before version 6.13.3↗2019-12-13
▶
OSV
CVE-2019-16776: Versions of the npm CLI prior to 6↗2019-12-13
▶
OSV
npm symlink reference outside of node_modules↗2019-12-13
▶

📋Vendor Advisories

3
Oracle
Oracle Oracle GraalVM Risk Matrix: JavaScript (Node.js) — CVE-2019-16776↗2020-01-15
▶
Red Hat
npm: Arbitrary file write via constructed entry in the package.json bin field↗2019-12-12
▶
Debian
CVE-2019-16776: npm - Versions of the npm CLI prior to 6.13.3 are vulnerable to an Arbitrary File Writ...↗2019
▶

💬Community

3
Bugzilla
CVE-2019-16776 npm: Arbitrary file write via constructed entry in the package.json bin field↗2020-01-06
▶
Bugzilla
CVE-2019-16776 nodejs: npm: Arbitrary file write via constructed entry in the package.json bin field [epel-all]↗2020-01-06
▶
Bugzilla
CVE-2019-16776 nodejs: Arbitrary file write via constructed entry in the package.json bin field [fedora-all]↗2020-01-06
▶
CVE-2019-16776 — Path Traversal in NPM CLI | cvebase