Versions of the npm CLI prior to 6.13.4 are vulnerable to an Arbitrary File Overwrite. It fails to prevent existing globally-installed binaries to be overwritten by other package installations. For example, if a package was installed globally and created a serve binary, any subsequent installs of packages that also create a serve binary would overwrite the previous serve binary. This behavior is still allowed in local installations and also through install scripts. This vulnerability bypasses a user using the --ignore-scripts install option.
History

No history.

cve-icon MITRE

Status: PUBLISHED

Assigner: GitHub_M

Published: 2019-12-13T01:00:21

Updated: 2024-08-05T01:24:47.252Z

Reserved: 2019-09-24T00:00:00

Link: CVE-2019-16777

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Modified

Published: 2019-12-13T01:15:11.007

Modified: 2024-11-21T04:31:10.213

Link: CVE-2019-16777

cve-icon Redhat

Severity : Low

Publid Date: 2019-12-12T00:00:00Z

Links: CVE-2019-16777 - Bugzilla