CVE-2019-16775: Unauthorized File Access in npm CLI before before version 6.13.3
Versions of the npm CLI prior to 6.13.3 are vulnerable to a symlink reference outside of nodemodules. It is possible for packages to create symlinks to files outside of the nodemodules folder through the bin field upon installation. A properly constructed entry in the package.json bin field would allow a package publisher to create a symlink pointing to arbitrary files on a user’s system when the package is installed. Only files accessible by the user running the npm install are affected.
References:
https://www.npmjs.com/advisories/1436 https://nodejs.org/en/blog/vulnerability/december-2019-security-releases/ https://blog.npmjs.org/post/189618601100/binary-planting-with-the-npm-cli
Other sources
Versions of the npm CLI prior to 6.13.3 are vulnerable to an Arbitrary File Write. It is possible for packages to create symlinks to files outside of thenodemodules folder through the bin field upon installation. A properly constructed entry in the package.json bin field would allow a package publisher to create a symlink pointing to arbitrary files on a user's system when the package is installed. This behavior is still possible through install scripts. This vulnerability bypasses a user using the --ignore-scripts install option.
— MITRE
Affected Software
Event History
Frequently Asked Questions
What is CVE-2019-16775?
CVE-2019-16775 is a vulnerability in versions of the npm CLI prior to 6.13.3 that allows for an arbitrary file write.
How does CVE-2019-16775 work?
CVE-2019-16775 allows packages to create symlinks to files outside of the node_modules folder through the bin field upon installation.
What is the severity of CVE-2019-16775?
CVE-2019-16775 has a severity value of 6.5, which is considered high.
How can I fix CVE-2019-16775?
To fix CVE-2019-16775, you should update to npm CLI version 6.13.3 or later.
Where can I find more information about CVE-2019-16775?
You can find more information about CVE-2019-16775 in the npm advisory and the Node.js blog post linked in the references.