Versions of the npm CLI prior to 6.13.3 are vulnerable to an Arbitrary File Write. It fails to prevent access to folders outside of the intended node_modules folder through the bin field. A properly constructed entry in the package.json bin field would allow a package publisher to modify and/or gain access to arbitrary files on a user's system when the package is installed. This behavior is still possible through install scripts. This vulnerability bypasses a user using the --ignore-scripts install option.
Metrics
Affected Vendors & Products
References
History
No history.
MITRE
Status: PUBLISHED
Assigner: GitHub_M
Published: 2019-12-13T00:55:16
Updated: 2024-08-05T01:24:48.040Z
Reserved: 2019-09-24T00:00:00
Link: CVE-2019-16776
Vulnrichment
No data.
NVD
Status : Modified
Published: 2019-12-13T01:15:10.913
Modified: 2024-11-21T04:31:10.063
Link: CVE-2019-16776
Redhat