CVE-2019-16775

Description

Versions of the npm CLI prior to 6.13.3 are vulnerable to an Arbitrary File Write. It is possible for packages to create symlinks to files outside of thenode_modules folder through the bin field upon installation. A properly constructed entry in the package.json bin field would allow a package publisher to create a symlink pointing to arbitrary files on a user's system when the package is installed. This behavior is still possible through install scripts. This vulnerability bypasses a user using the --ignore-scripts install option.

How to fix CVE-2019-16775

To remediate CVE-2019-16775, upgrade the affected package to a fixed version below.

• —upgrade to 6.13.4+ds-2 or later
• —upgrade to 6.13.3 or later

Is CVE-2019-16775 being exploited?

Low — EPSS is 1.1%, meaning exploitation activity has not been observed at scale.

Affected packages (2)

• from 0, < 6.13.4+ds-2
• from 0, < 6.13.3

CVSS scores

References (16)

• ADVISORYgithub.com/advisories/GHSA-m6cx-g6qm-p2cx
• ADVISORYnvd.nist.gov/vuln/detail/CVE-2019-16775
• ADVISORYsecurity-tracker.debian.org/tracker/CVE-2019-16775
• PATCHgithub.com/npm/cli
• WEB