Skip to content

Symlink reference outside of node_modules in npm

Low severity GitHub Reviewed Published Dec 13, 2019 in npm/cli • Updated Apr 19, 2022

Package

npm npm (npm)

Affected versions

< 6.13.3

Patched versions

6.13.3

Description

Versions of the npm CLI prior to 6.13.3 are vulnerable to a symlink reference outside of node_modules. It is possible for packages to create symlinks to files outside of thenode_modules folder through the bin field upon installation. A properly constructed entry in the package.json bin field would allow a package publisher to create a symlink pointing to arbitrary files on a user’s system when the package is installed. Only files accessible by the user running the npm install are affected.

This behavior is still possible through install scripts. This vulnerability bypasses a user using the --ignore-scripts install option.

Recommendation

Upgrade to version 6.13.3 or later.

References

@andreeleuterio andreeleuterio published the maintainer security advisory Dec 12, 2019

Severity

Low

Weaknesses

CVE ID

CVE-2019-16776

GHSA ID

GHSA-x8qc-rrcw-4r46

Source code

No known source code

Credits

Checking history
See something to contribute? Suggest improvements for this vulnerability.