PT-2019-1106 · Npm+6 · Npm+6
Published
2019-12-11
·
Updated
2023-01-24
·
CVE-2019-16775
CVSS v3.1
7.7
High
| Vector | AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:N |
Name of the Vulnerable Software and Affected Versions:
npm CLI versions prior to 6.13.3
Description:
The issue is related to errors in link handling in the npm and Yarn package managers. Exploitation of this issue may allow a remote attacker to write arbitrary files by creating a symbolic link to files outside the node modules directory or by manipulating the bin field in package.json. This can occur when a package is installed, and a properly constructed entry in the package.json bin field can create a symlink pointing to arbitrary files on a user's system. The vulnerability can bypass the --ignore-scripts install option and is still possible through install scripts. It can only affect files that the user running
npm install has access to and cannot overwrite existing files on disk.Recommendations:
Upgrade to version 6.13.3 or later. As a temporary workaround, consider restricting the use of the bin field in package.json to minimize the risk of exploitation. Avoid using install scripts until the issue is resolved.
Fix
Link Following
RCE
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Alt Linux
Almalinux
Centos
Red Hat
Rocky Linux
Suse
Npm