PT-2026-2326 · Npm · Npm Cli

Published 2024-11-13 · Updated 2026-05-07 · CVE-2026-0775

Positive Technologies (AI Summary)

CVSS v3.1

7.0

High

Base vector

AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions npm cli (affected versions not specified)

Description The npm command-line interface has a flaw related to incorrect permission assignment that can lead to local privilege escalation. This issue allows an attacker to gain elevated privileges on a system.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

LPE

Incorrect Permission

Weakness Enumeration

CWE-732

Related Identifiers

BDU:2026-01712

CVE-2026-0775

GHSA-3966-F6P6-2QR9

ZDI-26-043

Affected Products

Npm Cli

References · 14

• https://security-tracker.debian.org/tracker/CVE-2026-0775 · Vendor Advisory
• https://bdu.fstec.ru/vul/2026-01712 · Security Note
• https://zerodayinitiative.com/advisories/ZDI-26-043 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-0775 · Security Note
• https://cve.org/CVERecord?id=CVE-2026-0775 · Security Note
• https://ubuntu.com/security/CVE-2026-0775 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2026-0775 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-0775 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-3966-f6p6-2qr9 · Vendor Advisory
• https://osv.dev/vulnerability/ROOT-APP-NPM-CVE-2026-0775 · Vendor Advisory
• https://github.com/npm/cli · Note
• https://github.com/npm/cli/issues/8939 · Note
• https://twitter.com/SystemTek_UK/status/2011766115383337076 · Twitter Post
• https://twitter.com/CVEnew/status/2014576947486245208 · Twitter Post