CVE-2021-39135: UNIX Symbolic Link (Symlink) Following in @npmcli/arborist
First published: Tue Aug 31 2021(Updated: )
`@npmcli/arborist`, the library that calculates dependency trees and manages the node_modules folder hierarchy for the npm command line interface, aims to guarantee that package dependency contracts will be met, and the extraction of package contents will always be performed into the expected folder. This is accomplished by extracting package contents into a project's `node_modules` folder. If the `node_modules` folder of the root project or any of its dependencies is somehow replaced with a symbolic link, it could allow Arborist to write package dependencies to any arbitrary location on the file system. Note that symbolic links contained within package artifact contents are filtered out, so another means of creating a `node_modules` symbolic link would have to be employed. 1. A `preinstall` script could replace `node_modules` with a symlink. (This is prevented by using `--ignore-scripts`.) 2. An attacker could supply the target with a git repository, instructing them to run `npm install --ignore-scripts` in the root. This may be successful, because `npm install --ignore-scripts` is typically not capable of making changes outside of the project directory, so it may be deemed safe. This is patched in @npmcli/arborist 2.8.2 which is included in npm v7.20.7 and above. For more information including workarounds please see the referenced GHSA-gmw6-94gg-2rc2.
Credit: security-advisories@github.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Npmjs Arborist | <2.8.2 | |
| Npmjs Npm | <7.20.7 | |
| Oracle GraalVM | =20.3.3 | |
| Oracle GraalVM | =21.2.0 | |
| Siemens Sinec Infrastructure Network Services | <1.0.1.1 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is CVE-2021-39135?
CVE-2021-39135 is a vulnerability in `@npmcli/arborist` library that calculates dependency trees and manages the node_modules folder hierarchy for the npm command line interface.
What is the severity of CVE-2021-39135?
The severity of CVE-2021-39135 is high with a CVSS score of 7.8.
Which software are affected by CVE-2021-39135?
The software affected by CVE-2021-39135 are `@npmcli/arborist` versions up to 2.8.2, Oracle GraalVM 20.3.3 and 21.2.0, and Siemens Sinec Infrastructure Network Services up to version 1.0.1.1.
How can I fix CVE-2021-39135?
To fix CVE-2021-39135, update `@npmcli/arborist` to a version higher than 2.8.2, upgrade Oracle GraalVM to a version beyond 20.3.3 or 21.2.0, and update Siemens Sinec Infrastructure Network Services to a version higher than 1.0.1.1.
Where can I find more information about CVE-2021-39135?
You can find more information about CVE-2021-39135 in the following references: [Siemens advisory](https://cert-portal.siemens.com/productcert/pdf/ssa-389290.pdf), [GitHub Security Advisory](https://github.com/npm/arborist/security/advisories/GHSA-gmw6-94gg-2rc2), [npm package reference](https://www.npmjs.com/package/@npmcli/arborist).
- collector/nvd-index
- agent/weakness
- agent/type
- agent/remedy
- collector/mitre-cve
- source/MITRE
- agent/title
- agent/severity
- agent/last-modified-date
- agent/author
- agent/references
- agent/softwarecombine
- agent/tags
- agent/description
- agent/first-publish-date
- agent/event
- vendor/npmjs
- canonical/npmjs arborist
- canonical/npmjs npm
- vendor/oracle
- canonical/oracle graalvm
- version/oracle graalvm/20.3.3
- version/oracle graalvm/21.2.0
- vendor/siemens
- canonical/siemens sinec infrastructure network services