CVE-2019-16777: Arbitrary File Overwrite in npm CLI
Versions of the npm CLI prior to 6.13.4 are vulnerable to a Global nodemodules Binary Overwrite. It fails to prevent existing globally-installed binaries to be overwritten by other package installations.
References:
https://www.npmjs.com/advisories/1437 https://nodejs.org/en/blog/vulnerability/december-2019-security-releases/ https://blog.npmjs.org/post/189618601100/binary-planting-with-the-npm-cli
Other sources
Versions of the npm CLI prior to 6.13.4 are vulnerable to an Arbitrary File Overwrite. It fails to prevent existing globally-installed binaries to be overwritten by other package installations. For example, if a package was installed globally and created a serve binary, any subsequent installs of packages that also create a serve binary would overwrite the previous serve binary. This behavior is still allowed in local installations and also through install scripts. This vulnerability bypasses a user using the --ignore-scripts install option.
— MITRE
Affected Software
Event History
Frequently Asked Questions
What is CVE-2019-16777?
CVE-2019-16777 is a vulnerability in versions of the npm CLI prior to 6.13.4 that allows for arbitrary file overwrite.
How severe is CVE-2019-16777?
CVE-2019-16777 is classified as high severity with a CVSS score of 6.5.
Which software versions are affected by CVE-2019-16777?
Versions prior to 6.13.4 of the npm CLI, 8.17.0, 10.18.0, 12.14.0, and 13.4.0 of Node.js, Npmjs Npm, openSUSE Leap, Oracle GraalVM, Fedora, and Redhat Enterprise Linux are affected.
How do I fix CVE-2019-16777?
To fix CVE-2019-16777, update to version 6.13.4 of the npm CLI or later.
Where can I find more information about CVE-2019-16777?
You can find more information about CVE-2019-16777 on the npm advisory page (https://www.npmjs.com/advisories/1437), the Node.js blog (https://nodejs.org/en/blog/vulnerability/december-2019-security-releases/), and the npm blog (https://blog.npmjs.org/post/189618601100/binary-planting-with-the-npm-cli).