Lucene search

@npmcli/arborist vulnerable to UNIX Symbolic Link (Symlink) Following

🗓️ 31 Aug 2021 16:03:04Reported by GitHub Advisory DatabaseType

@npmcli/arborist Vulnerable to UNIX Symbolic Link (Symlink) Following, Arbitrary File Creation, Overwrite, Code Execution

5 of 5AI Insights are available for you today

Leverage the power of AI to quickly understand vulnerabilities, impacts, and exploitability

Reporter	Title	Published	Views	Family All 61
AlpineLinux	CVE-2021-39134	31 Aug 202117:15	–	alpinelinux
Cvelist	CVE-2021-39134 UNIX Symbolic Link (Symlink) Following in @npmcli/arborist	31 Aug 202116:55	–	cvelist
IBM Security Bulletins	Security Bulletin: Security Vulnerabilities affect IBM Cloud Private - Node.js (CVE-2021-39134)	22 Apr 202219:38	–	ibm
IBM Security Bulletins	Security Bulletin: IBM App Connect Enterprise Certified Container Integration Servers may be vulnerable to a symlink attack due to CVE-2021-39134	7 Oct 202110:29	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple vulnerabilities affect IBM Rational® Application Developer for WebSphere® Software - September 2021	16 Nov 202119:47	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple vulnerabilities in Node.js affect IBM Rational Application Developer for WebSphere Software included in Rational Developer for i	12 Dec 202119:49	–	ibm
IBM Security Bulletins	Security Bulletin: IBM InfoSphere Information Server is affected by multiple vulnerabilities in Node.js	29 Oct 202121:37	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Security Verify Governance is vulnerable to multiple security issues due to Node.js	22 Aug 202215:20	–	ibm
IBM Security Bulletins	Security Bulletin: High severity vulnerabilities in libraries used by IBM Spectrum Discover (libraries of libraries)	27 Apr 202222:57	–	ibm
OSV	CVE-2021-39134	31 Aug 202117:15	–	osv

Vulners

Node

npmcli arboristRange<2.8.2

Source	Link
github	www.github.com/npm/arborist/security/advisories/GHSA-2h3h-q99f-3fhc
npmjs	www.npmjs.com/package/@npmcli/arborist
nvd	www.nvd.nist.gov/vuln/detail/CVE-2021-39134
oracle	www.oracle.com/security-alerts/cpuoct2021.html
cert-portal	www.cert-portal.siemens.com/productcert/pdf/ssa-389290.pdf
github	www.github.com/advisories/GHSA-2h3h-q99f-3fhc

Transform Your Security Services

Elevate your offerings with Vulners' advanced Vulnerability Intelligence. Contact us for a demo and discover the difference comprehensive, actionable intelligence can make in your security strategy.

Book a live demo

31 Aug 2021 16:04Current

7High risk

Vulners AI Score7

CVSS24.4

CVSS37.8 - 8.2

EPSS0.01359

npmcli arborist vulnerability symbolic link arbitrary file creation overwrite code execution npm dependency file systems patches fix caveat package-lock update