CVE-2021-39134

🗓️ 31 Aug 2021 16:55:11Reported by GitHub_MType

cve🔗 web.nvd.nist.gov📰️ 10 Media mentions👁 176 Views🌐 WEB

@npmcli/arborist, CVE-2021-39134 fix for symlink dependency vulnerability

Reporter	Title	Published	Views	Family All 107
IBM Security Bulletins	Security Bulletin: Security Vulnerabilities affect IBM Cloud Private - Node.js (CVE-2021-39134)	22 Apr 202219:38	–	ibm
IBM Security Bulletins	Security Bulletin: IBM App Connect Enterprise Certified Container Integration Servers may be vulnerable to a symlink attack due to CVE-2021-39134	7 Oct 202110:29	–	ibm
IBM Security Bulletins	Security Bulletin: IBM InfoSphere Information Server is affected by multiple vulnerabilities in Node.js	29 Oct 202121:37	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Security Verify Governance is vulnerable to multiple security issues due to Node.js	22 Aug 202215:20	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple vulnerabilities in Node.js affect IBM Rational Application Developer for WebSphere Software included in Rational Developer for i	12 Dec 202119:49	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple vulnerabilities affect IBM Rational® Application Developer for WebSphere® Software - September 2021	16 Nov 202119:47	–	ibm
IBM Security Bulletins	Security Bulletin: High severity vulnerabilities in libraries used by IBM Spectrum Discover (libraries of libraries)	27 Apr 202222:57	–	ibm
ALT Linux	Security fix for the ALT Linux 10 package node version 14.17.6-alt1	1 Sep 202100:00	–	altlinux
FreeBSD	Node.js -- August 2021 Security Releases (2)	31 Aug 202100:00	–	freebsd
attackerkb	CVE-2021-39134	31 Aug 202117:15	–	attackerkb

NVD

Vulners

Node

AND

npmjs arboristRange<2.8.2node.js

npmjs npmRange<7.20.7

Node

oracle graalvmMatch20.3.3enterprise

oracle graalvmMatch21.2.0enterprise

Node

siemens sinec_infrastructure_network_servicesRange<1.0.1.1

[
  {
    "product": "arborist",
    "vendor": "npm",
    "versions": [
      {
        "status": "affected",
        "version": "< 2.8.2"
      }
    ]
  }
]

Source	Link
npmjs	www.npmjs.com/package/%40npmcli/arborist
cert-portal	www.cert-portal.siemens.com/productcert/pdf/ssa-389290.pdf
github	www.github.com/npm/arborist/security/advisories/GHSA-2h3h-q99f-3fhc
oracle	www.oracle.com/security-alerts/cpuoct2021.html

Parameter	Position	Path	Description	CWE
foo	path	/some/path	On case-insensitive file systems, conflicting dependencies with file: symlinks could cause arbitrary content to be written to a targeted path.	CWE-178, CWE-61
FOO	path	/some/path	On case-insensitive file systems, conflicting dependencies with file: symlinks could cause arbitrary content to be written to a targeted path.	CWE-178, CWE-61

17 Jun 2026 04:03Current

6.5Medium risk

Vulners AI Score6.5

CVSS 24.4

CVSS 3.17.8 - 8.2

EPSS0.00576